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EXECUTIVE SUMMARY 

The evolution of sensor, data acquisition, communications, and information analysis 
technologies enables the development of health monitoring (HM) systems for real-time 
condition assessment for predicting failures of aircraft components or subsystems. This 
information could be disseminated to ground stations to allow condition-based 
maintenance for long-term flight safety arid operational capacity, or to the aircrew or air 
traffic control in a manner that allows effective in-flight response. There are two primary 
aspects to consider in the approval of HM systems for commercial aviation and acceptance 
by the operators of commercial air transports — (1) airworthiness certification of the on- 
board system and (2) qualification and approval of HM system capabilities as part of the 
airline maintenance program. 

The purpose of this study was to assess the connection between current FAA regulations 
and the incorporation of HM systems into commercial aircraft. To address the overall 
objectives ARINC (1) investigated FAA regulatory guidance, (2) investigated airline 
maintenance practices, (3) systematically identified regulations and practices that would be 
affected or could act as barriers to the introduction of HM technology, and (4) assessed 
regulatory and operational tradeoffs that should be considered for implementation. The 
assessment procedure was validated on a postulated structural HM capability for the B757 
horizontal stabilizer. 

Airworthiness regulations that are applicable to on-board HM systems require that 
compliance would have to be shown primarily by analysis, supported by ground, flight, or 
simulator tests. In general, ARINC found that current regulations do not prohibit, but 
could represent barriers to the use of HM technologies. To reduce regulatory barriers to 
HM systems, ARINC recommends that the following general changes should be sought in 
the FAA’s regulatory guidance. 

• Revise airworthiness directives to explicitly allow “certificated condition- 
monitoring systems” as a means for compliance. 

• Include guidance for utilizing the capabilities of HM systems in the 
development of maintenance and inspection tasks and intervals. 

• Add provisions to realize maintenance credits for introducing HM systems in 
mandated inspection or maintenance requirements. 

The timely introduction of HM systems requires that an alliance be developed between air 
carriers and the manufacturers of the integrated systems. ARINC recommends that initial 
development should focus on addressing the concerns of the air carriers — unscheduled 
maintenance problems, difficult or tedious inspections, accessibility problems, or 
component reliability problems. 
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ABBREVIATIONS AND ACRONYMS 


Airworthiness Directive 
advisory circular 

Aircraft Communications Addressing and Reporting System 
aircraft certification office 
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airplane evaluation group 

Artificial Intelligence Exchange and Service Tie to All Test 

Environments 

Air Mobility Command 
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air traffic control 

Air Transportation Oversight System 
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Code of Federal Regulations 
certification maintenance requirement 
Continuous maintenance visits 

designated engineering representative 
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flight operations quality assurance 
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long period grating 
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maintenance process data 
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module test and maintenance 

National Aeronautics and Space Administration 
network server system 
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O&M 

operations and maintenance 

OMS 

On-Board Maintenance System 

PCU 

power control unit 

PTDF 

Parametric Test Data Format 

PMA 

parts manufacturing approvals 

QAR 

quick access recorder 

RTCA 

Requirements and Technical Concepts for Aviation 

SB 

service bulletin 

STCM 

stabilizer trim control module 

SME 

subject-matter expert 

STC 

supplemental type certification 

TC 

type certification 

TIA 

type inspection authorization 

TSO 

technical standard order 

TSOA 

TSO authorization 
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ANALYSIS OF REGULATORY GUIDANCE FOR HEALTH 

MONITORING 


SECTION 1 
INTRODUCTION 


1.0 BACKGROUND 

Modern commercial transports are configured with sophisticated electronic, propulsion, 
flight control, and structural data systems. In recent years, an increased emphasis has been 
placed on the potential for using these data capabilities, in conjunction with emerging 
sensor, data processing, and conditioning technologies for health monitoring (HM) of 
aircraft condition during flight. Implementation of such HM technologies is expected to: 

• Identify and correct (or mitigate) performance or airworthiness problems before 
they compromise safety 

• Improve flight crew performance and decision support 

• Enhance aircrew training and operating procedures, air traffic control (ATC) 
procedures, and aircraft operations, maintenance, and design 

• Perform trend analyses to identify problems, implement and evaluate corrective 
actions, and assess performance over time 

The fundamental intent is to use real-time flight data to detect unsafe conditions early 
enough to allow timely intervention. Initially, these efforts were focused on assessing and 
monitoring safety and airworthiness data only. However, over the last several years, they 
have been expanded to include the consideration of operations and maintenance (O&M), 
decision support, cost, and design data. 

As currently envisioned, integrated HM capabilities would consist of on-board systems for 
sensing and real-time diagnostics and ground-based systems for longer-term diagnostics 
and prognostics. The onboard systems would include a variety of sensors; sensor data 
conditioning units; on-board diagnostic processors and algorithms; and interfaces with on- 
board power, data, and communications systems. The ground systems would include 
diagnostic and prognostic processors and algorithms, communications systems, and links 
to airline maintenance history records. 

Acceptance and use of emerging HM by the air carriers will ultimately depend upon the 
objective demonstration of a number of factors. These factors include: 

• Documented and convincing cost/benefit 

• Feasibility to replace difficult or tedious inspections 

• Potential to improve overall component reliability 
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• Ability to collect and analyze recurring problems 

• Potential to move tasks from line maintenance checks and put them into base 
maintenance visits, where maintenance personnel have more time and access 
for inspection and maintenance tasks 

Once the feasibility and cost-effectiveness of these HM systems have been demonstrated 
to air carriers, the ability to navigate the FAA’s certification process will be a critical 
factor in their eventual implementation. 

1.1. PURPOSE 


As described above, aircraft health monitoring could o ffer m any operational and logistical 
benefits, ultimately resulting in improved aircraft safety and reduced maintenance burden 
for the operators. However, commercial operators have pointed out that, for health 
monitoring systems to be operationally and economically viable, regulatory guidance from 
the FAA and the new capabilities provided by health-monitoring technologies must be 
compatible. The potential benefit of health-monitoring technology can only be realized 
with effective coordination between aircraft operators and regulatory authorities. 

The purpose of this study was to provide a procedure for assessing the connection 
between current regulatory guidance and the incorporation of health monitoring systems 
into commercial aircraft. To accomplish this, an assessment was made of the implications 
of current regulatory guidance and of air carrier maintenance and preventive maintenance 
practices on the implementation of health-monitoring technologies. The resulting 
assessment procedure was validated on a postulated HM capability for a selected 
component. 

This report summarizes the results of the ARINC analysis of regulatory issues on the 
implementation of HM systems. 


1 . 2 . SCOPE AND APPROACH 

The scope of the study included: (1) an investigation of regulatory guidance that drives 
certification and maintenance practices, (2) an investigation of existing airline maintenance 
practices and how they were derived from the regulatory guidance, (3) a systematic 
identification of regulations and practices that will be affected by implementation of HM 
technologies, and (4) an assessment of regulatory and operational tradeoffs that should be 
considered during the implementation of HM technologies. 

The approach to accomplishing the regulatory analysis included the following tasks: 

• Research existing processes and procedures relative to the impact of 
implementation of HM 
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• Develop a set of evaluation categories that are common to Federal Aviation 
Regulations (FARs), maintenance operations/inspections, and HM systems that 
will be suitable for relational database adaptation. The relational database was used 
to identify those FARs and aircraft certification/maintenance requirements that will 
be impacted by installing an airborne HM system 

• Obtain, archive, and categorize applicable regulatory guidance, including FARs, 
Advisory Circulars (ACs), and Airworthiness Directives (ADs) 

• Obtain, archive, and categorize applicable FAA-required maintenance 
operations/inspection data on 737 and 757 models 

• Categorize the features and capabilities of a postulated HM capability for a 757 
horizontal stabilizer 

• Populate a relational database with categorized data on FARs, as well as 
maintenance operations/inspection requirements 

• Query the database to identify FAR and maintenance operations/inspection 
requirements that may be impacted by installing the postulated HM system on the 
selected aircraft 

• Evaluate, using subject-matter experts, those areas where FARs and aircraft 
certification/maintenance requirements could act as barriers to the postulated HM 
system 

• Summarize findings 

The 757 horizontal stabilizer, including the main stabilizer assembly and the elevators, was 
chosen to establish postulated HM capability for assessment. The underlying goals were to 
identify implementation barriers and assess the compatibility of near-term health- 
monitoring technologies with the existing regulatory structure. 

A number of sources were used in conducting this study. Regulatory documents (including 
FARs, ACs, ADs, and Orders) were obtained from a variety of public or corporate data 
sources. Preliminary input on air carrier maintenance programs was obtained through the 
Avionics Maintenance Conference and more detailed information was developed through 
discussions and data exchanges with maintenance program managers from selected air 
carriers (i.e.. United Airlines, UPS, and Airborne Express). Maintenance program 
development guidance information was discussed with FAA maintenance program 
authorities (i.e., FAA Flight Standards National Resource Specialist for Maintenance 
Programs). Finally, manufacturers technical data on the 757, including the maintenance 
and maintenance training manuals, maintenance process data, and maintenance task cards 
were consulted. 

The study results are organized into five sections: 

• Section 2 includes an identification of the regulations that apply to aircraft 
certification and operations, a review of the requirements that are contained in the 
applicable regulations, and an overview of the certification process 

• Section 3 includes a description of airline maintenance programs and of how they 
are developed 
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• Section 4 is a summary of the database development, the regulatory assessment 
approach, and the case study to validate the assessment approach 

• Section 5 contains the study results 

• Section 6 contains conclusions and recommendations 
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SECTION 2 

REGULATION AND GUIDANCE 


2.0 INTRODUCTION 

The FAA regulates the safety of aircraft design and operations by their oversight of the 
certification process for aircraft design and manufacture and of the continued 
airworthiness process for operations, maintenance, and training. This section describes the 
regulations that are applicable to the approval of the design, manufacture, and operation of 
aircraft and products; the requirements for the type certification for an aircraft or aircraft 
modification; the certification process; and post -certification activities. 

2.1 APPLICABLE REGULATIONS 

There are a series of Federal Aviation Regulations (FARs) within Title 14 of the Code of 
Federal Regulations, as well as guidance documents, that pertain to most aspects of 
design, manufacture, and operation of civil aircraft. FARs establish certification 
requirements for aircraft designs, requirements for manufacturers' production quality 
control systems, the requirements for airworthiness certification of individual aircraft, and 
the operations and maintenance rules for air carriers and repair facilities [1], The FAA 
Aircraft Certification Service and the Flight Standards Service administer these 
regulations. A listing of all of the FARs is included as in Appendix A. Even though this 
review includes regulations for all types of aircraft, the focus for this study was on large 
commercial transport aircraft. 

The FAA’s current approach to managing aircraft safety (Figure 2-1) includes oversight of 
design and manufacture through certification rules (airworthiness standards); flight 
operations, maintenance and training through operating rules (operating requirements); 
and continued airworthiness through mandated and voluntary service experience reporting 
requirements. The regulations that apply directly to aircraft design and operation include 
airworthiness certification regulations for aircraft and engines (Table 2-1) and operating 
regulations (Table 2-2). For large commercial transport aircraft, the applicable FARs 
include Part 21 (Certification Procedures for Products and Parts), Part 25 (Airworthiness 
Standards: Transport Category Airplanes), Part 33 (Airworthiness Standards: Aircraft 
Engines, Part 91 (General Operating and Flight Rules), Part 1 19 (Certification: Air 
Carriers and Commercial Operators), and Part 121 (Operating Requirements: Domestic, 
Flag, and Supplemental Operations. In addition, Part 39 incorporates all Airworthiness 
Directives into the FAR system. 

This analysis focused on the regulations that would have the greatest applicability to 
design and implementation of health monitoring systems for transport category aircraft, 
including Part 25, Part 121, and selected Airworthiness Directives. 
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FIGURE 2-1. Aircraft Certification and safety management process. 
Source: Improving the Continued Airworthiness of Civil Aircraft, 
National Research Council, Washington, DC: National Academy Press 
(1998). Reprinted with permission. ©1998 by the National Academy of 
Sciences. 


Table 2-1 Airworthiness Certification Regulations for Aircraft, Engines, and Propellers 

CFR Part No. CFR Subchapter and Title 

Certification Procedures For Products and Parts 

Airworthiness Standards: Normal, Utility, Acrobatic, and Commuter Category Airplanes 
Airworthiness Standards: Transport Category Airplanes 
Airworthiness Standards: Normal Category Rotorcraft 
Airworthiness Standards: Transport Category Rotorcraft 
Airworthiness Standards: Manned Free Balloons 
Airworthiness Standards: Aircraft Engines 
Airworthiness Standards: Propellers 



Part 23 
Part 25 
Part 27 
Part 29 
Part 31 
Part 33 
Part 35 
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Table 2-2 Operating Regulations 


CFR Part No. 


CFR Subchapter and Title 


Part 119: Certification: Air Carriers and Commercial Operators 

Part 121: Certification and Operations: Domestic, Flag, and Supplemental Air Carriers and 

Commercial Operators of Large Aircraft 

Part 125: Certification and Operations: Airplanes Having a Seating Capacity of 20 or More 

Passengers or a Maximum Payload Capacity of 6,000 Pounds or More 
Part 129: Operations: Foreign Air Carriers and Foreign Operators of U.S.- Registered Aircraft 

Engaged in Common Carriage 
Part 1 33: Rotorcraft External-Load Operations 

Part 135: Air Taxi Operators and Commercial Operators 

Part 137: Agricultural Aircraft Operations 

Part 1 39: Certification and Operations: Land Airports Serving Certain Air Carriers 


2.1.1 Airworthiness Standards 

Airworthiness standards are administered by the FAA Aircraft Certification Service. These 
documents establish the general requirements that must be met for type certification. The 
purpose of airworthiness standards is to validate that the design and manufacture of the 
aircraft are such that the aircraft will meet the FAA's reliability requirements. 

Airworthiness standards include requirements for the following: 

• Flight characteristics, including weight and balance and performance 

• Structures, including flight load and failure load conditions, structural design 
criteria, and durability/damage tolerance 

• Design and construction, including general materials and processing 
requirements as well as specific requirements for controls, landing gear, hulls, 
personnel and cargo accommodation, emergency provisions, ventilation and 
heating, cabin pressurization, and fire protection 

• Powerplants, including installation and system integration, fuel and oil systems, 
cooling, exhaust systems, controls, and fire protection 

• Equipment, including instruments, electrical systems, lights, and safety 
equipment 

• Operating limitations 

FAR 25 establishes airworthiness requirements for the certification of transport category 
aircraft (all aircraft designs with 10 or more seats [excluding seats for the flight crew] or a 
maximum takeoff weight of more than 12,500 pounds). 


2.1.2 Operating Requirements 

Operating requirements are administered by the FAA Flight Standards organization. These 
documents establish regulations and practices for owners and operators to ensure that 
aircraft are operated and maintained properly. Operating requirements include the 
following: 
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• approval of routes 

• manual requirements 

• aircraft requirements 

• operating limitations 

• special airworthiness requirements 

• instrument and equipment requirements 

• maintenance, preventive maintenance, and alterations 

• airman and crewmember requirements, qualifications, and certification 

• training 

• dispatcher qualifications and duty time 

• flight time limitations 

• flight operations 

• records and reports 

FAR 121 establishes the operating requirements for domestic, flag, and suppleme ntal ..... 
carriers and organizations performing maintenance for air carriers. The requirements that 
will have the greatest effect on implementation of HM systems include maintenance 
program requirements, instrument and equipment requirements, and special airworthiness 
requirements (beyond Part 25 requirements). 


2.1.3 Airworthiness Directives 

Airworthiness Directives (ADs) are mandatory inspections, modifications, or maintenance 
actions that are implemented in response to safety-related service experience or potentially 
unsafe conditions. ADs are incorporated into the regulations by releasing them as 
amendments to FAR 39. 

The aircraft owners and operators are responsible for assuring compliance with applicable 
ADs. Although some ADs are recurring (i.e., they require continued actions or 
inspections), most require terminating actions by the air carriers. Many ADs result from 
manufacturer’s “Service Bulletins” or “All-Operator Letters” that suggest inspection, 
maintenance, or modification procedures and intervals (if applicable). Compliance with 
these types of manufacturer’s alerts can be a condition of continued warranty coverage for 
the subject component, even if an AD is not issued. 


The air carriers recognize that the AD process is necessary for correcting near-term safety 
concerns. However, many feel that ADs should not be used to imposejoutine maintenance 
requirements because they also impose administrative burdens on the air carriers and limit 
compliance options [2]. Although the air carriers are not amenable to ADs that must be 
kept open for scheduled inspections, structural inspection programs, modification 
programs, and corrosion protection and control programs for aging aircraft have been 
implemented through ADs (See tables 2-3, 2-4, and 2-5). These aging aircraft ADs are 
generally recurring requirements, which need to be incorporated into the air carriers’ 
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maintenance programs. Individual operators can request FAA approval of another 
approach to addressing the requirements of a particular AD (alternative means of 
compliance). Alternative means of compliance could include HM systems. 
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2.2 FAA CERTIFICATION REQUIREMENTS 

FAA certification involves a series of assessments that lead to the issuance of an 
airworthiness certificate for individual aircraft by the FAA Administrator. A number of 
analyses support the airworthiness certification, including an assessment of the 
fundamental design (type certification), an evaluation of the processes used to produce the 
aircraft (production approval), and an evaluation of the capability of the operators to 
operate the aircraft safely and to maintain the aircraft in airworthy condition (continued 
airworthiness). 

This section includes a general description of FAA certification requirements and examples 
of how the requirements apply to health monitoring systems. 


2.2.1 Airworthiness Certification 

Title 49 of the United States Code gives the Administrator of the FAA the responsibility 
to issue a Standard Airworthiness Certificate for each eligible aircraft registered in the 
United States. An airworthiness certificate indicates that the FAA has determined that the 
aircraft (1) conforms to an FAA-approved type design and (2) is in safe operating 
condition. Standard airworthiness certificates are supported by type certificates and 
production approvals. The airworthiness certificate is effective as long as the operations, 
maintenance, preventative maintenance, and alterations are performed in accordance with 
FAR parts 2 1 (Certification Procedures for Products and Parts), 43 (Maintenance 
Preventive Maintenance, Rebuilding, and Alteration), and 91 (General Operating and 
Right Rules). Special airworthiness certificates, including primary, restricted, limited, 
provisional, and experimental, can also be issued. 


2.2.2 Type Certification 

The type certification process, which could include initial type certification or 
supplemental type certification, assesses the design of a new product or a proposed 
design modification to an existing product. Type certificates are issued upon (separate) 
approval of new and modified designs of aircraft, aircraft engines, and propellers. 

Initial Type Certification (TC) is the FAA process for approval of new products. In 
general the basis for type certification includes (1) applicable airworthiness standards 
(FAR, part 25 for transports), (2) special conditions developed to address novel or 
unusual design features, (3) standards for fuel venting and emissions, and (4) exemptions 
to the above standards made “in the public interest.” 3 Design changes can be made during 


a FAR Part 21, §21.17 designates the applicable regulations to establish a certification basis. 
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the life cycle of the aircraft design. Minor b changes must be evaluated against the original 
type certification basis and relevant ADs. Minor changes to type designs are generally 
approved by the manufacturer’s Designated Engineering Representative (DER). Major 
changes, which result in amendments to the original type certificate, usually involve the 
introduction of a derivative to an existing model. The type certification basis for a 
derivative design is generally considered to be the type certification basis for the original 
type design, supplemented by additional requirements to address novel and unusual design 
features of the derivative design. All ADs must be incorporated into the derivative design. 
Testing and analyses are only conducted where the original results are not applicable to 
the derivative design. 

Supplemental Type Certification (STC) is the FAA process to approve modifications to 
improve existing products when someone other than the holder of the type certificate asks 
the FAA to approve the design changes. As is the case with derivative aircraft, the 
certification basis for STC is the type certification basis for the original type design 
modified as needed. However, because of the manufacturer’s proprietary rights, the 
applicant might not be granted access to the supporting data for the original TC. In this 
case, the applicant might have to “reverse-engineer” the component to establish test and 
validation requirements. If unsuccessful, the applicant could be required to withdraw their 
application. 


2.2.3 Production Approvals 

The purpose of production approvals is to e nsu re that the manufacturers of certificated 
components are capable of repeatably producing components that represent the 
certification basis. There are three principal types of production approvals allowed in FAR 
Part 21 — (1) production certificates, (2) technical standard order (TSO) authorizations, 
and (3) parts manufacturer approvals (PMAs). Alternatively, components may be 
manufactured under the authority of a TC (or STC) only. 

The production approvals that will be most applicable to health-monitoring systems are 
production certificates for the integrated system and TSO authorizations for generally 
applicable system components. 


2.2.3. 1 Production Certificates 

Production certificates are issued by the FAA Administrator to signify approval of the 
producer’s quality system and quality control data. Production certificates may be issued 
to holders of current type certificates or STCs, Production certificates can simplify the 
certification process for individual aircraft because they allow the holder to obtain 


h A minor change is defined in FAR Part 21 (§21 .93) as “one that has no appreciable effect on the weight, 
balance, structural strength, reliability, operational characteristics, or other characteristics affecting the 
airworthiness of the product.” All other changes are defined as major. 
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approval for installation on type certificated aircraft or to obtain an airworthiness 
certificate without further process inspections or audits. 

Manufacturers of health-monitoring systems would need to apply for approval under a 
production certificate. Generally the application would be made at the same time as 
application for TC or STC, even though a production certificate cannot be issued until a 
TC or STC has been approved. Obtaining a production certificate for installation on a 
particular aircraft type would facilitate approval of subsequent installations on the same 
aircraft type. 


2.2.3.2 Technical Standard Orders 

Technical Standard Orders (TSOs) are minimum performance standards for specified 
materials, parts, processes, or devices used on civil aircraft. There are 2 principal ways 
that the FAA acknowledges compliance with a specified TSO: (1) A TSO authorization 
(TSOA), which is a design and production approval issued to the manufacturer, and (2) a 
letter of TSO design approval, which is a design approval for a foreign-manufactured 
article. An approved TSO Authorization (or letter of TSO design approval) signifies 
approval of the component design and the manufacturer’s facilities and processes. 

Although TSOs are most often used for stand-alone electronics and avionics components, 
they could be used for any products, parts, and devices that are considered by the FAA to 
be generally applicable and useful. Hence, TSOs could facilitate the approval of health- 
monitoring system components, including sensors and signal-conditioning hardware and 
on-board processors. However, a TSO is applicable only to the particular product, part, 
and device and does not constitute approval for installation on an aircraft. The integrated 
HM system would require separate production approvals for installation. 


2.2. 3. 3 Parts Manufacturer Approvals 

Parts Manufacturer Approvals (PMAs) are required for the production of modifications or 
replacement parts for installation on a type certificated product. PMAs apply to parts that 
cannot be produced under a type or production certificate, by an owner or operator for 
maintaining or altering his own product, or under a TSO. An approved PMA signifies that 
the manufacturer has shown (through tests and inspections) that the design meets 
airworthiness requirements for the product on which the part is to be installed; and that 
the manufacturer’s fabrication and inspection system is acceptable. 

PMAs would not be likely to apply to the initial certification of a HM system or 
components because they generally apply to individual replacement parts, not integrated 
systems. 
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2.2.4 Operations and Maintenance: Continued Airworthiness 

Applicants for a TC or STC are required by FAR Part 21 to prepare “Instructions for 
Continued Airworthiness.” The specific requirements are contained in applicable 
airworthiness standards (e.g., FAR Part 25 for large transports). These instructions are 
required to be given to the operator when the aircraft is delivered or when the first 
standard airworthiness certificate for the affected aircraft is issued, whichever occurs later. 
The instructions may be incomplete when the TC (or STC) is issued as long as the above 
delivery requirements are met (i.e., prior to delivery of the first aircraft or issuance of a 
standard certificate of airworthiness). The instructions for continued airworthiness include: 

• the aircraft maintenance manual or section 

• maintenance instructions 

• access information 

• special inspection techniques 

• application of protective treatments to the structure after inspection 

• data relative to structural fasteners such as identification, discard 
recommendations, and torque values 

• special tools 

Air carrier programs to maintain continued airworthiness are discussed in Chapter 4. The 
focus of HM systems is to improve programs to assure conti nue d airworthiness. Thus, the 
required modifications to continued airworthiness programs and the resulting air carrier 
inspection and maintenance programs are critical considerations in the implementation of 
HM systems. 

2.2.5 Summary 

FAA certification of HM systems would include an assessment of the fundamental design 
(type certification), an evaluation of the processes used to produce the HM system 
(production approval), and an evaluation of operational safety (continued airworthiness). 
The most likely approach to type certification of HM systems for existing aircraft is STC 
because the manufacturers of the systems will make the applications for type certification. 
Production approvals for HM systems will probably be granted through production 
certificates, supplemented with TSOs for some system components. Modification of 
continued airworthiness programs to realize the potential benefits of HM systems would 
be evaluated during the type certification process. 
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2.3 CERTIFICATION PROCESS 

A schematic of the type certification process, alongside a typical product development 
process, is shown in Figure 2-2. The certification process is outlined, from the FAA’s 
point of view, in FAA order 8 1 10-4 A [3]. The detailed steps involved in a typical 
certification are described in this section with an emphasis on STCs, the most likely 
approach for the certification of health-monitoring systems. The following section 
describes the specific approach for the certification of HM systems. 
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Product Development 


Applicant Actions 


FAA Actions 



Continued Airworthiness 
Determination 


Issue Type Certificate 


Utilization and Support 


Post-Certification Activities 


FIGURE 2-2. Type Certification Process 
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The first step in the certification process is to apply for a TC or STC, using FAA Form 
81 10-12, Application for Type Certificate, Production Certificate, or Supplemental Type 
Certificate. In the case of an STC, the application would be submitted to the applicable 
regional aircraft certification office (ACO). The application should specify either a “one- 
only” STC, which would apply to only one aircraft/engine/propeller serial number, or a 
“multiple” STC, which would apply to two or more aircraft/engines/propellers. For 
“multiple” STCs, the applicant must demonstrate that the modification can be duplicated. 
At the same time, the applicant should apply for a production certificate. The FAA, 
through the responsible ACO, then establishes the project by assigning a project number, a 
project manager, and notifying the accountable directorate. If necessary, the accountable 
directorate will assign a project officer. 

The applicant develops and submits a proposed certification plan that includes [4]: 

• High-level description of the design 

• Proposed compliance documentation 

• Proposed designees 

• Suggested certification basis 

• Compliance checklist 

• Project schedule 

The FAA develops a formal certification program plan that establishes roles of the FAA 
participants and the responsibilities of the applicant, and the program schedule. The FAA 
then identifies the certification basis that will be applied to the TC or STC program. The 
certification basis will consist of the initial certification basis plus those requirements 
effective on the date of the application that are generally related to the components or 
areas affected by the proposed modification. It is essential for the applicant to consider the 
certification basis in the development of the detail design so that the design data will 
address the issues identified in the certification plan. 

Once the applicant has completed the detailed design, the type design and substantiating 
data are submitted to the FAA for evaluation to show compliance with applicable 
regulations and special conditions prescribed by the FAA. The type design includes: 

• Drawings and specifications 

• Information on dimensions, materials, and processes 

• Airworthiness limitations 

• Other data necessary to describe the design of the product 

The FAA recommends using a compliance checklist that addresses all of the applicable 
regulations so that problem areas can be identified early in the type certification program. 
The FAA will approve the data when the product has been shown to conform to the type 
design and applicable airworthiness requirements. 
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The applicant prepares a test plan to show compliance to applicable regulations for design 
or modifications. The test plan should include: 

• Description of test articles 

• Required test equipment 

• Description of calibration procedures 

• Compliance requirements 

• Step-by-step test procedures 

The FAA will approve the test plan, perform conformity inspections (to ensure that the 
product complies with the type design), and witness testing. Prior to final installation, it 
may be required that individual components or subassemblies be subjected to inspections 
or tests. 

Once the product has been found to conform to the type design, the installation will be 
inspected to determine compliance to applicable regulations. Extensive analysis and testing 
is generally required for compliance determination. Determination of compliance will 
include a detailed safety assessment, an evaluation of performance under service 
environmental conditions, and an assessment of the software aspects of certification. An 
engineering compliance inspection provides an opportunity to review an installation and its 
relationship to other installations on a product. Flight Standard’s airplane evaluation 
groups (AEG) may conduct an evaluation of acceptability of operations and 
maintainability concurrently with engineering compliance inspections. 

Once the aircraft has been modified and all data have been approved, the FAA prepares a 
type inspection authorization (TIA) for official conformity, airworthiness inspections, and 
flight tests necessary to fulfill certification requirements. If required, the FAA issues an 
experimental airworthiness certificate to permit flight testing. The applicant then conducts 
their own certification tests of the complete installation (without FAA inspectors) to 
assure that the installation will comply with all requirements. When testing has been 
completed, a flight test report is submitted to the FAA for review. 

Upon acceptance of the applicants flight test report, conformity inspections are 
accomplished by FAA manufacturing inspection personnel or an FAA designee. Official 
certification tests are conducted or witnessed by FAA personnel or FAA designees. 

The AEG participates in the aircraft certification engineering compliance inspections and 
flight test programs. The AEG will: 

• Participate in compliance and TIA testing to evaluate operational suitability 

• Review maintenance programs for continuing airworthiness and develop the 
maintenance review board report 

• Review flight manuals and revisions 

• Develop master minimum equipment lists (MELs) 

• Establish type rating requirements 
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• Participate in crew complement determinations 

• Participate in emergency evacuation demonstrations 

• Establish acceptance of flight crew sleeping quarters 

• Establish any unique or special training requirements 

• Participate in functional and reliability testing 

• Manage the Flight Standardization Board, Flight Operations Evaluation Board, 
and Maintenance Review Board 

If required, the FAA prepares a certification summary report, which summarizes the 
record of the FAA examination of a type design, discusses significant safety issues, and 
describes how compliance with the applicable regulations was verified. 

The applicant prepares instructions for continued airworthiness for submittal to the FAA. 
The instructions may be incomplete at the time of type certification, but the airworthiness 
limitations must be approved by the FAA. 

Finally,the FAA issues the TC or STC. 


2.4 CONTINUED OPERATIONS 

Once certification requirements have been met and a standard airworthiness certification 
has been issued, the aircraft enters service. Operators and manufacturers are responsible 
for tracking the product performance and reliability according to the requirements for 
continued airworthiness. The FAA is responsible for monitoring continued compliance. As 
improved systems and data analysis technologies have become available, more quantitative 
means to monitor aircraft safety have been introduced. Air carriers have implemented 
Fight Operations Quality Assurance (FOQA) programs and the FAA has implemented the 
Air Transport Oversight System (ATOS). The following sections describe each of these 
programs. 

2.4.1 Flight Operations Quality Assurance (FOQA) 

Right Operational Quality Assurance (FOQA) involves the analysis of flight data to 
identify and correct problems or anomalous occurrences before they adversely affect flight 
operations or safety. The implementation of a FOQA program by an airline requires them 
to have the capability to (1) capture critical flight data parameters, (2) process and analyze 
the collected data, and (3) use the analysis to improve future flight operations. HM 
systems could facilitate the implementation of FOQA programs by providing embedded 
data collection and evaluation capabilities. 

European and Asian air carriers led the commercial aviation industry in the implementation 
of formal FOQA programs to quantify and assess flight performance and safety data as 
standard operating procedures. Most notably, eight non-US airlines — British Airways, 
Japan Airlines, KLM-Royal Dutch Airlines, Lufthansa German Airlines, and the 
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Scandinavian Airlines System — have been using FOQA programs for over 15 years. These 
air carriers are convinced that FOQA programs are a critical component of their respective 
safety, O&M, and training management efforts, and that such programs pay operational, 
maintenance, and economic dividends. 

US air carriers have been reluctant to implement such programs primarily because of 
concerns over liability, data protection, and cost effectiveness [5]. Data protection and 
security has been a controversial and sensitive concern of the US air carriers, aircrew 
personnel, and professional associations who have been concerned that flight data 
developed under FOQA programs could be used for punitive or disciplinary action. 
However, as the benefits of FOQA programs have been demonstrated in the international 
aviation community, some US airlines have initiated efforts to adopt such systems on a 
trial basis. 

In 1991, the FAA, recognizing the value of operational flight data and flight crew 
performance in preventing incidents and accidents, selected the Flight Safety Foundation 
(FSF) to study FOQA. In its subsequent report back to the FAA, FSF stated that: 

“...the appropriate use of FOQA data by airlines, pilot associations, and aircraft 
and equipment manufacturers would result in a significant improvement of flight 
safety by identifying operational irregularities that can foreshadow accidents and 
incidents.” [6] 

FSF concluded that FOQA programs should be implemented by US air carriers involved in 
FAR Part 121 operations (large transports). FSF recommended that the FAA promote the 
implementation of voluntary FOQA programs by instituting a d emonstration program in 
partnership with the aviation industry. In response to the FSF recommendations, the FAA 
initiated a $5.5 million FOQA demonstration project in 1995. The purpose of the 
demonstration was to promote and facilitate the voluntary implementation of aviation 
quality assurance programs by US air carriers and to assess the potential costs, benefits, 
and safety enhancements. 

The implementation of the FOQA demonstration project was voluntary, but highly 
recommended, for certificate holders operating under FAR Part 121. The FAA provided 
the participating air carriers with specialized equipment for continuously recording 
hundreds of different flight-data parameters from aircraft systems and sensors. For 
example, the FAA provided quick access recorders (QARs) to each of the participating 
airlines for installation on 15 of their Boeing 737 for capturing FOQA flight data. In 
addition, as necessary, the FAA also provided ground analysis systems — including 
hardware and software — for analyzing, correlating, and presenting FOQA-generated data. 
The participating carriers bore the cost of obtaining supplemental type certification of the 
airborne FOQA equipment; the cost of installing, integrating, testing, and maintaining this 
equipment; and the cost of providing personnel and resources to manage, execute, 
support, and monitor the FOQA program. 
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Even though only four US air carriers — Continental, United, US Airways, and Alaska — 
were initially selected to participate in this program, their experience with the FOQA 
program indicated that: 

• FOQA provides more-objective, quantitative data on what occurs during flight 
than what is reported by individuals (e.g., aircrew). 

• FOQA data yields information about flight operations, performance, and 
airworthiness that can be used to help objectively evaluate and address a wide 
range of safety-related issues. 

• FOQA data facilitates the identification and characterization of previously 
unknown or suspected airworthiness problems that can result in timely, cost- 
effective corrective actions that significantly reduce safety-related risks. 
Furthermore, where problems are already known, FOQA data can help to confirm 
and quant ify the extent and severity of these problems. 

• FOQA programs can help air carriers accurately determine the frequency of certain 
flight occurrences and maintenance events, rather than relying on human 
judgement or subjective procedures, particularly with respect to maintenance, 
inspection, and airworthiness requirements. 

• FOQA findings enable air carrier managers to responsibly update, refine, and 
modernize training and safety programs. 

• FOQA data can help air carrier maintenance managers make more informed 
decisions about whether their aircraft need to be inspected, repaired, or overhauled 
due to damage or degradation. 

• FOQA trends and metrics can help air carriers validate whether corrective actions 
and procedural changes are effective. 

Although the focus of FOQA is primarily safety related, financial benefits can be realized 
as well. Although the actual cost benefits to be realized from implementing a FOQA 
program depend on a large number of factors, air carriers have found that the responsible 
use of FOQA-generated data can help to: 

• Improve aircraft availability and O&M productivity 

• Reduce unneeded maintenance, inspections, repairs, and overhauls 

• Reduce maintenance delays and flight cancellations 

• Lower insurance premiums, liability risk, and litigation expenses associated with 
accidents and incidents 

FAA cost estimates project that, for an inventory of 50 state-of-the-art aircraft, air carriers 
could conceivably realize a net savings of approximately $892,000 per year from reduced 
expenditures for fuel, maintenance, and direct accident-related costs [7]. Potentially, 
additional O&M cost savings could be realized as a result of FOQA-enabled enhancements 
to aircrew performance and training, aircraft and ATC operating procedures, aircraft 
maintenance and operations support, and airport design and maintenance. 
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Based on the favorable results of the demonstration, the FAA has chosen to promote 
FOQA as a voluntary initiative (rather than a regulatory mandate) through a cooperative 
partnership with the US aviation industry. In addition to the four original participating 
carriers, several other airlines (e.g., America West Airlines, Continental Express, Delta Air 
Lines, Northwest Airlines, Southwest Airlines, Trans World Airlines, American Airlines, 
and United Parcel Service) are considering the implementation of FOQA (or FOQA-like) 
programs. In addition, NASA (under contract to the FAA) is developing an advanced 
system for conducting automated analysis and research on FOQA-generated data. 

Implementation of HM systems could be an important factor in air carrier efforts to 
introduce FOQA programs. HM systems promise to automate the data collection and 
analysis functions associated with maintenance program review. These capabilities are 
consistent with the goals for FOQA programs. 


2.4.2 Air Transportation Oversight System (ATOS) 

The FAA has the responsibility to oversee post-certification activities to assure that 
aircraft and air travel remain safe. To perform this function, the FAA has recently 
introduced ATOS, which is based on a risk management approach to system safety, rather 
than just audits of regulatory compliance [8], 

ATOS is a result of collaboration between the FAA and Sandia National Laboratories 
(SNL) to revitalize the FAA oversight process based on SNL’s “accidents are 
unacceptable" nuclear safety policy. The goal of ATOS is to foster increased air carrier 
safety using a systematic, data-driven approach to identify safety trends and prevent 
accidents. Inspectors look at the air carrier’s organizational and operational processes as a 
whole and determine how systems interact to maintain safety. Under the previous 
approach, air carriers received mandatory, scheduled inspections specified in an annual 
work program based on their level of operations. Additional inspections were conducted 
at the discretion of the carrier’s principal FAA inspector. This "expert-based," non- 
systematic approach relied on the expertise of the inspectors assigned to an air carrier. 

ATOS was first implemented in October 1998, with a focus on the 10 major US passenger 
air carriers (i.e., Alaska, America West, American, Continental, Delta, Northwest, 
Southwest, TWA, United and US Airways). Also, new carriers that seek operational 
certification will fall under ATOS surveillance. ATOS is continually evolving based on 
feedback from FAA inspectors and air carriers. 

The implementation of ATOS is not expected to represent a barrier to the introduction of 
HM systems. In fact, the focus on risk management and data-driven oversight instead of 
an approach driven solely by regulatory compliance could facilitate the introduction of 
automated tools such as HM. 
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SECTION 3 

AIR CARRIER MAINTENANCE PROGRAMS 


3.0 INTRODUCTION 

Operators of commercial aircraft develop and implement maintenance and preventive 
maintenance programs, not only to comply with regulations and guard against liability, but 
also to maximize the availability of individual aircraft (by minimizing aircraft down time) 
and to protect their considerable capital investment in aircraft and equipment. The 
objectives of an effective maintenance program are to accomplish the following in a cost- 
effective manner [9]: 

• Ensure that the inherent component safety and reliability levels are realized 

• Restore component safety and reliability to their inherent levels if deterioration 
occurs 

• Obtain information necessary for design improvement of components with 
inadequate inherent reliability 

As described in the previous chapter, FAR Part 2 1 requires that manufacturers provide 
complete instructions for continued airworthiness when the aircraft is delivered or when 
the first standard airworthiness certificate is issued. To implement these instructions, FAR 
Part 121 (for large transports) assigns responsibility for performing maintenance, 
inspections, and alterations to the operators. 

Air carrier profitability relies critically on the productivity of individual aircraft. The 
requirements for aircraft utilization have been steadily increasing in recent years. Current 
schedules and route structures are such that aircraft could see as many as 16 hours per day 
of service. High utilization aircraft could approach 6000 hours in a year, a number that has 
been steadily increasing over the past 10-15 years, and results in fewer opportunities to 
bring an aircraft in for maintenance [10]. 

The primary consideration for assessing the effect of HM systems on continued 
airworthiness is to determine their potential influence on scheduled maintenance programs. 
HM systems could be an important factor in improving the effectiveness of inspection and 
maintenance programs and enabling focused, condition-based maintenance. Ultimately, 
these improvements would increase air carrier profitability. 

This section describes the development of air carrier maintenance programs, the 
implementation of these programs by commercial operators, tracking of component 
reliability, and procedures for program review and modification. 


3.1 MAINTENANCE PROGRAM DEVELOPMENT 
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Continuous airworthiness maintenance programs are developed by the aircraft operators 
and approved by the FAA. The basic elements of a continuous airworthiness maintenance 
program includes the following [11]: 

• Aircraft inspection, including routine inspections, servicing, and tests performed 
on the aircraft at prescribed intervals 

• Scheduled maintenance (i.e., maintenance tasks performed at prescribed intervals), 

including replacement of life-limited items, components requiring replacement for 
periodic overhaul, special inspections, checks or tests for on-condition items, and 
lubrication - : ■•••••• • •• , 

• Unscheduled maintenance (i.e., maintenance tasks generated by the inspection and 
scheduled maintenance elements, pilot reports, failure analyses, or other indications 
of a need for maintenance) 

• Engine, propeller, and appliance repair and overhaul 

• Structural inspection program and airframe overhaul 

• Required inspection items (i.e., safety-critical items) 

• Maintenance manuals, which define the continuous airworthiness maintenance 
program 

There has been a gradual evolution of aircraft maintenance philosophy to embrace 
reliability control methods as an integral part of an approved aircraft maintenance program 
[12]. This transition is evident in the three approaches to preventive maintenance currently 
applied to commercial transport components — hard time, on-condition, and condition 
monitored, as described in the following paragraphs. 

Early (first-generation) air carrier maintenance programs were developed under the 
assumption that each functional component needed periodic disassembly for inspection. 
This led to the implementation of hard time maintenance processes, where components 
are removed from service when they reach a predetermined service parameter (e.g., flight 
hours, flight cycles, or calendar time). 

However, the majority of aircraft components do not exhibit old-age wear-out that would 
be conducive to hard time maintenance. The principal reliability pattern for complex 
aircraft systems is high initial failure rates, followed by random incidence of failure 
throughout the remaining life [10]. Replacing such components at a prescribed age 
actually reduces overall reliability because the poor initial reliability is introduced more 
often. This led to the implementation of on-condition maintenance processes, where 
periodic visual inspection, measurements, tests or other means of verification are used to 
establish component condition without disassembly, inspection or overhaul. 

Finally, the industry and regulatory authorities developed methods to establish 
maintenance program requirements by tracking component failure rates and maintaining an 
acceptable level of reliability. Reliability methods identified components that respond to 
neither hard time nor on-condition approaches. This led to the implementation of 
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condition monitoring maintenance processes, where component performance is monitored 
and analyzed, but no formal services or inspections are scheduled. c 

Airline maintenance programs include all three maintenance approaches as appropriate. 
Maintenance tasks are developed and implemented for individual components by 
component manufacturers and operators based on detailed analyses of component 
performance, potential failure modes and consequences, and reliability of similar 
components in service. The approaches used by air carriers to identify maintenance tasks 
are outlined in the following sections. 

HM systems could provide benefit to the operators in each of the maintenance scenarios 
described above. First, hard time components could be converted to one of the reliability- 
based approaches by identifying faults that are precursors to failure and monitoring the 
components using a HM system. Second, HM systems could be used to automate the 
inspection, measurements, and tests for on-condition components. Finally, HM systems 
can be used to detect the precursors to failure for condition-monitored components so that 
maintenance or replacement activities can be anticipated and scheduled. 


3.1.1 New Aircraft Programs (MSG process) 

Airlines recommend initial maintenance tasks for new aircraft based on a detailed analysis 
approach [9], Each major subsystem is considered by a Maintenance Steering Group 
(MSG) sanctioned by the Air Transport Association (AT A). These groups consist of 
senior maintenance engineers from each carrier that will operate the aircraft type, as well 
as representatives of the manufacturer and the FAA. The groups identify significant 
maintenance tasks in critical systems using a rigorous evaluation process that includes the 
following general steps: 

• Identify subsystem function 

• Predict potential failure modes based on analysis or experience with similar 
designs 

• Analyze the failure modes using an established logic that considers 
consequences of failure (e.g., affects safety, undetectable, operational impact, 
economic impact) 

• Write maintenance tasks and intervals based on the above assessment (e.g., 
lube/service, crew monitoring, operational check, inspection/functional check, 
remove and restore, or remove and discard) 

Figure 3-1 shows a simplified logic diagram for developing maintenance tasks for systems 
and powerplant components. The logic approaches are extended to a detailed level to 


c This definition of condition monitoring differs from the definition traditionally used in nondestructive 
evaluation or process controls. The traditional definition implies that parameters that would provide 
evidence of impending failure events are monitored. For the current definition performance relative to an 
alert value indicating failure is monitored. 
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evaluate and select appropriate maintenance tasks for each potential failure event [9]. 
Similarly, structural designs are evaluated to identify potential structural failure processes, 
assess the ability to detect indications of each failure mechanism, and determine the 
potential consequences of each failure event (or multiple events acting simultaneously). 
Inspection, maintenance, and modification tasks for structures are developed based on the 
results of these analyses. 

Once the maintenance tasks are produced by the MSG-3, the individual carriers add or 
modify the tasks for their operations to develop a maintenance list. The list is submitted to 
the FAA regional office for acceptance (not approval). Although there is no requirement 
for the airlines to develop a maintenance list, submitting the list for acceptance can 
expedite the required FAA approval of the maintenance plan (Airline Maintenance 
Manual). 

Separately (until the 777), the manufacturers develop a manufacturer’s Maintenance 
Manual (MM), which includes structural airworthiness limitations, certification 
maintenance requirements (CMR) d , and servicing and lubrication requirements. Based on 
their MM, the manufacturers develop maintenance process data (MPD) and maintenance 
task cards. In their evaluation of Airline Maintenance Manuals, the FAA makes sure that 
the maintenance tasks and intervals are consistent with the manufacturer’s 
recommendations, although the carriers’ processes can deviate from the MM requirements 
with FAA approval. Because the MSG-3 process does not continue after certification, 
new maintenance or modification tasks resulting from service experience (introduced 
through FAA Airworthiness Directives and Advisory Circulars, or manufacturer’s All- 
Operators Letters and service bulletins), are formalized in the manufacturers MM. 

As a result of the MSG-3 activities, second- and third-generation transport aircraft have 
formalized fault tree analyses for each major subsystem. These could be invaluable in the 
development of health-monitoring systems that target critical components and are 
consistent with the air carriers’ maintenance programs. 


1 


i 


1 

E 


3.1.2 Existing Aircraft 

Operators who purchase new aircraft later in their manufacturing life-cycle or purchase 
aircraft previously operated by another carrier, are also required to develop maintenance 
plans and manuals to be approved by the FAA. The development of an air carrier 
maintenance program for an aircraft type that has been in service builds on existing 
analyses as well as service experience. 


d Certification maintenance requirements (CMRs) are required periodic tasks that are established during 
airworthiness certification as operating limitations of the type certificate [9], 
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Generally, the operators develop maintenance tasks based on the manufacturer’s 
guidelines for assuring continued airworthiness, which are included in the MPD and 
maintenance task cards. In addition, programs are often substantially influenced by 
previous service and maintenance history and by establish and approved maintenance 
programs. These resources are adapted to meet the operator’s maintenance capability and 
operations (e.g., cargo vs. passenger operation; operator vs. contractor heavy 
maintenance). Most airline operators use the inspection and maintenance work processes 
as prescribed by the manufacturer. The program can be tailored by grouping individual 
tasks into an overall maintenance program that is compatible with the carriers capabilities 
and operations. 

Additional mandated inspections, maintenance actions, or modifications are introduced 
through ADs. Although most ADs require terminating actions to restore the component to 
an airworthy condition, some require ongoing inspections and modification that must be 
incorporated in the maintenance program. The operator of purchased aircraft must assess 
the status of open ADs to ensure that the ongoing requirements are met. 

It is often difficult for carriers who purchase previously owned aircraft to determine the 
status of previous service bulletins (SBs). Many SBs suggest an inspection and assessment 
followed by modification, depending on the results of the inspection. When compliance 
with a SB is indicated, the new operator must ascertain whether only the inspection was 
done or if the modifications were also made. If an operator executes a MPD-based 
maintenance program, most SBs will be implemented. 

Existing HM systems could help airlines maintain the continuity in their inspection and 
maintenance programs when individual aircraft change ownership. Automated 
maintenance and inspection recording and flight data archives would enable the new 
owner to establish the condition of the monitored components. 
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3.2 MAINTENANCE PROGRAM IMPLEMENTATION 

Once maintenance tasks and intervals have been established, the air carrier must develop 
an implementation plan, consistent with their operations and capabilities, to accomplish 
scheduled maintenance tasks. A typical maintenance program has a series of scheduled 
maintenance “checks,” where maintenance tasks are grouped so that they can be 
accomplished with minimal downtime. 

There are a number of approaches to implementing inspection and maintenance intervals 
that comply with manufacturers’ suggestions and are complementary with the carriers’ 
operations. The following are examples of approaches to organizing maintenance tasks 
into checks [13]: 

• Block programs, where the aircraft is broken into inspection areas (zones) or 
systems and all of the A-level or C-level checks are accomplished at an 
appropriate visit. 

• Segmented programs, where each check interval is broken up into 
subintervals. For example, instead of performing one large A-check at 4000 
hours, the carrier can perform 4 smaller checks at 1000, 2000, 3000, and 4000 
hours. Either way, the required work is done within the specified time. 

• Phased programs, which is similar to a segmented program except that all A- 
level segments are completed within each B-level increment, and similarly for 
higher-level checks. 

• Continuous maintenance visits (CMV) programs, where individual tasks are 
assigned an initial check and a prescribed interval. For example a task might 
start at the second C-check (C2) and be repeated at every third C-check from 
then on (3C interval). 

The FAA does not prescribe how the operators must organize their tasks, so an acceptable 
maintenance program could be organized using any of these methods or by combining the 
methods. The checks for a typical maintenance program are shown in Table 3-1. 


31 


Regulatory Guidance for Health Monitoring 


Table 3 -1. Typical Airline Maintenance and Service Plan 


When Service is Performed 

Type of Service Performed 

Impact on Airline 
Service 

Prior to each flight 

“Walk-around” - visual check of aircraft 
exterior and engines for damage, and 
leakage 

None 

Every 2-7 days 

Service check (line maintenance 
opportunity) - service consumables 
(engine oils, hydraulic fluids, oxygen) 
and tire and brake wear 

Overnight layover 

Every 25-40 days 

A-checks (line maintenance check) - 
detailed check of aircraft and engine 
interior, service and lubrication of 
systems (e.g., ignition, generators, 
cabin, air conditioning, hydraulics, 
structures, and landing gear) 

Overnight layover 

Every 45-75 days 

B-checks (packaged A-checks) - torque 
tests, internal checks, and flight 
controls 

Overnight layover 

Every 12-15 months 

C-checks (base maintenance visit) - 
detailed inspection and repair of 
engines and systems 

Out of service 3-5 days 

Every 2-5 years (depending 
on usage or mandatory 
inspection/modification 
requirements) 

Heavy maintenance visit (or 
maintenance program visit) - corrosion 
protection and control program and 
structural inspections/modifications 

Out of sen/ice up to 30 
days 


Source: Based on New Materials for Next-Generation Commercial Transports, NMAB-476, 


National Research Council, Washington, DC: National Academy Press (i996). 

Scheduled maintenance is set at calendar intervals based on anticipated aircraft usage. 
Flight hours and cycles are monitored for each aircraft and aircraft are scheduled into the 
principal maintenance facilities for checks. Implementation of maintenance tasks is 
generally done by zone, not by subsystem. Zone groups perform all of the maintenance 
tasks that are required for all of the subsystems (e.g., hydraulics, electronics, structures, 
etc.) accessible within the given zone. There are exceptions to the zone grouping 
philosophy; for example, functional leak testing of hydraulic systems must be performed 
on the entire system during a C-check because of the complexity of instrumentation and 
test methods. 

Some mandated inspections or maintenance actions are keyed to cycles or flight hours 
rather than calendar time. For instance, fatigue damage of fuselage structures develops as 
a function of the number of pressurization cycles whereas fatigue damage of wing and 
empennage structures develops as a function of gust and maneuver loads, which depend 
on flight hours. In cases where regulations or modifications are tied to cycles or hours, a 
separate tracking is established that can override scheduled maintenance intervals to 
accommodate the regulations. 

Individuals who perform maintenance and alterations of aircraft are required to use 
methods, techniques, and practices acceptable to the FAA (FAR Part 43, §43. 13). The 
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FAA prefers the methods set forth in the manufacturer's maintenance manual and the 
instructions for continued airworthiness. Alternatively, air carriers can use different 
methods as long as they have been approved as part of their required maintenance 
manual. Therefore, air carriers have the authority to introduce new maintenance 
and inspection techniques and to implement those changes through their manual. 
Because HM can be considered to be an alternative method to perform a scheduled 
inspection or maintenance check, HM systems could be implemented through approved 
changes in the carrier’s maintenance manual. 


3.3 PROGRAM REVIEW AND RELIABILITY TRACKING 

Commercial operators are required by FAR Part 121, §121.373 to establish and maintain 
continuous monitoring and surveillance programs to ensure that inspection and 
maintenance programs are, and continue to be, effective. The operators are responsible for 
work performed at their own facilities as well as for work performed according to their 
inspection and maintenance program by others. The requirement to establish and maintain 
a continuous monitoring and surveillance program effectively establishes a quality control 
or internal audit function to assure that everyone involved in the inspection and 
maintenance program is in compliance with the operator's manuals and applicable 
regulations. 

Reliability-based maintenance programs (per AC 120-17A) allow inspection and 
maintenance intervals and methods to be set (and modified) based on demonstrated 
reliability. Typically, operators track the mean time to unit failure' to identify reliability 
trends. These data are used to upgrade the maintenance program and to identify design 
flaws that should be addressed by the manufacturer. 

Individual operators have different approaches to program review and to the collection 
and use of reliability data. Generally, these programs are designed to track the frequency 
of unscheduled parts replacement or need for unscheduled maintenance, the frequency of 
adjustment and calibration of equipment, and problems that affect operational capability or 
reliability. Many carriers “zero base” their maintenance program periodically to clear out 
added maintenance activity that has shown little improvement to aircraft availability or 
reliability. 

Health monitoring systems could be an integral part of an airline’s monitoring and 
surveillance and reliability tracking programs. HM systems promise to automate the data 
collection and analysis functions associated with maintenance program review. These 
capabilities are also consistent with the goals for FOQA programs. 


e For aircraft types that are utilized in multiple roles, mean time to unit failure must also consider how the 
aircraft fleet is utilized (e.g., many short flights vs. fewer, longer flights). 
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SECTION 4 

ASSESSMENT OF REGULATORY IMPACTS 
4.0 INTRODUCTION 

The objective for implementing HM technology on commercial aircraft is to augment, 
reduce, or replace difficult or unnecessary inspections required of FAA certificated 
operators in order to improve flight safety and aircraft availability and reduce operating 
costs. A key concern of certificated operators is whether the current regulations would 
allow the approval and introduction of automated HM systems. The purpose of this 
assessment was to identify the current regulatory guidance that would allow airworthiness 
certification and maintenance program development to implement HM systems on 
transport aircraft and to point out where regulations could act as barriers to HM system 
implementation. 

Three key tasks were used to identify regulatory guidance that would serve as barriers to 
the use of HM systems on commercial aircraft: 

• Develop a searchable data archive of regulatory information 

• Develop and execute tailored queries of the data archive to identify, extract, 
and assess the regulatory information related to HM systems 

• Use subject-matter experts (SMEs) to analyze the results of the queries and 
identify guidance that could act as barriers to the certification and use of HM 
systems on transport category aircraft 

The assessment included two principal levels of analysis. First, general guidance for the 
certification of HM systems was assessed. The description of certification and regulatory 
requirements in Sections 2 and 3 was based, in part, on this assessment. Second, specific 
guidance was assessed for the certification of a postulated HM system for the B757 
horizontal stabilizer as a case study by which to validate the method. 


4.1 REGULATORY DATABASE 


The regulatory data archive was developed to enable rapid, thorough, and repeatable 
identification of regulations and guidance related to aircraft certification, maintenance, 
inspection, and airworthiness. It also provided an efficient tool for examining related 
subject matter for analytical purposes and to report findings. 

A similar archive has been developed previously to examine the regulatory impact of 
adding an all-weather flight control system (glass cockpit) and global positioning 
system/enhanced navigation system on the US Air Force Air Mobility Command’s (AMC) 
C- 141 Aircraft [21]. The findings allowed AMC to develop and issue regulatory guidance 
concurrent with the establishment of the increased C-141 operational capability. A similar 
archive was developed for the KC-10 aircraft regulatory guidance that allowed the 
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identification of missing/conflicting guidance, redundant material and opportunities for 
standardizing guidance on operational issues. 

The regulatory information contained in the data archive consists of those FARs and ACs 
that apply to aircraft certification, maintenance, inspection, and airworthiness, both 
generally and for transport category aircraft. The archive served as the reference source 
for current regulatory guidance. The regulatory information included in the data archive 
was identified by screening the indices of all FARs, ACs, and ADs applicable to the B737 
and B757 aircraft. Specific data selection criteria included: 

• All regulatory information generally applicable to inspection, certification, 
maintenance, airworthiness, or operations 

• All regulatory information applicable to transport category (excluding rotor 
craft) aircraft and components 

• All ADs applicable to the B737 and B757 aircraft 

The AD archive for the B737 was developed because it included the supplementary 
inspection, maintenance, and modification tasks related to the aging of aircraft structures. 
The AD archive for the B757 was assembled specifically to support the B757 stabilizer 
case study. 

The FARs contained in the data archive were identified and electronically downloaded 
from the FAA internet site [http://www.faa.gov]. The ACs were identified from the 
Advisory Circular Checklist, Appendix 3, Numerical List of Advisory Circulars, as 
presented on the FAA internet site [http://www.faa.gov/ac-chklst/actoc.htm]. The ACs 
were obtained in electronic form from various internet and public information sources. The 
B737 and B757 ADs were obtained from a CD Document Library [14]. 


The regulatory data archive was created as a Microsoft Access 97 database. The records 
are structured such that the standard features of Access 97 can be used to enter and 
extract data, review record content, and generate reports. The data archive contains the 
following FARs, ACs, and ADs: 


FEDERAL AVIATION REGULATIONSs 

General Rule Making Procedures 
Certification Procedures for Products and Parts 
Airworthiness Standards: Normal, Utility, Acrobatic, and 
Commuter Category Airplanes 

Airworthiness Standards: Transport Category Airplanes 
Airworthiness Directives 

Maintenance, Preventive Maintenance, Rebuilding, and Alteration 
Certification: Air Carriers and Commercial Operators 
Operating Requirements: Domestic, Flag, and Supplemental 
Operations 


Part 

11 

Part 

21 

Part 

23 

Part 

25 

Part 

39 

Part 

43 

Part 

119 

Part 

121 
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Part 125 Certification and Operations: Airplanes Having a Seating Capacity 
of 20 or More Passengers or a Maximum Payload Capacity of 6000 
Pounds or More and Rules Governing Persons on Board Such 
Aircraft 

Part 145 Repair Stations 

Part 1 83 Representatives of the Administrator 


ADVISORY 

AC 20-65 

AC 20-77 
AC 20- 107 A 
AC 25-7 
AC 25-19 
AC 120-16C 
AC 1 20- 1 7 A 
AC 121-1 A 

AC 12 1-22 A 


CIRCULARS 

U.S. Airworthiness Certificates and Authorizations for Operation of 

Domestic and Foreign Aircraft 

Use of Manufacturers Maintenance Manuals 

Composite Aircraft Structure 

Flight Test Guide for Certification of Transport Category Airplanes 

Certification Maintenance Requirements 

Continuous Airworthiness Maintenance Programs 

Maintenance Control by Reliability Methods 

Standard Operations Specifications: Aircraft Maintenance 

Handbook 

Maintenance Review Board Procedures 


AIRWORTHINESS DIRECTIVES 

Boeing 737 ADs All 

Boeing 757 ADs All 


Each record contains, if applicable, the fields and information shown in Table 4-1, 

Database Fields. Each record contained all the available information to identify the data 
source and provide the exact text of a specific paragraph or section (e.g., FAR 
subsection). Each record also contains fields for categorizing regulatory guidance for the 
purpose of sorting information according to established criteria. These category fields 
were chosen because they identified regulatory subject matter that could be related to HM 
systems requirements, capabilities, use, and certification. Some category fields - those 
indicated as “Entry - TBD” in the “Entry Information” column - were established in the 
database structure but not used for this study. These fi elds will have use in future studies 
and analyses such as selection of target systems and components for HM utilization, 
cost/benefit trade studies, identification of operational considerations for HM systems, 
analysis of requirements for data collection and recording, and requirements for training of 
maintenance personnel. 
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Table 4-1 - Database Fields 


Field Name 

Field Description 

Entry Information 

ID 

Record Identification Number 

Automatically assigned 

Document Type 

Self Explanatory 

FAR, AC or AD 

Document Number 

Self Explanatory 

As applicable 

Document Title 

Self Explanatory 

As applicable 

Document Date 

Self Explanatory 

As applicable 

Document Sub Part 

Self Explanatory 

As applicable - If used 

Sub Part Title 

Self Explanatory 

As applicable - If used 

Paragraph Number 

* 

Self Explanatory 

As applicable - If used 

Paragraph Title 

Self Explanatory 

As applicable - If used 

Paragraph Text 

Self Explanatory 

Entire text of paragraph (limited 
formatting) 

General 

Record has general Application 

Entry - TBD 

Inspection 

Record relates to Inspection 

N - Not impacted by HM 

I - Impacted by HM 

P - Prohibits use/certification of HM 

MRB (Maintenance Review Board) 

Record relates to MRB 

Entry - TBD 

Certification 

Record relates to Certification 

N - Not impacted by HM 

I - Impacted by HM 

P- Prohibits use/certification of HM 

Airworthiness 

Record relates to Airworthiness 

N - Not impacted by HM 

I - Impacted by HM 

P - Prohibits use/certification of HM 

Alterations 

Record relates to aircraft alterations 

Entry - TBD 

Maintenance 

Record relates to maintenance 

N - Not impacted by HM 

I - Impacted by HM 

P - Prohibits use/certification of HM 

CMR (Certification Maintenance 
Requirements) 

Record related to CMR 

Entry - TBD 

Aircraft 

Record applies to specific aircraft or 
type of aircraft 

B737, B757, Others - TBD 

Engine 

Record applies to aircraft engines 

Entry - TBD 





4.2 ASSESSMENT OF GENERAL REGULATORY GUIDANCE 

Broad data queries were used to identify and assess general regulatory requirements 
applicable to HM systems. The roots (shown in bold) of the words “certification”, 
“maintenance”, “inspection”, and “airworthiness” are common terms used in the 
regulatory guidance contained in the FARs, ACs, and ADs that can be generally related to 
the capabilities of and requirements for HM systems. Tailored queries were used to search 
the regulatory document archive for these roots to identify the regulatory requirements 
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that apply to aircraft or components, with an emphasis on structures and structural 
components. 

There were two phases to the SME analysis. In the first phase, individual SMEs examined 

the results of the tailored queries and classified each record hit as either [IJmpactcd, [N]ot I 

impacted, or [Prohibited. : l - | 

• “Impacted” means that the guidance contained in that record could act as a barrier « 

to the use or certification of the postulated HM system. 

• “Not impacted” means that the guidance in that record is not expected to act as a 
barrier to use or certification of HM systems (i.e., the guidance is not applicable or 

already permits use or certification of HM systems). ! 

• “Prohibited” means that the regulatory guidance, as written prohibits the use or ! 

certification of the postulated HM system. 

The SMEs entered the results of their analysis in the appropriate fields of the database by 

coding each record hit with an “I”, “N”, or “P”. s 

In the second phase, the database was queried to identify all records that were classified as 1 

“I” or “P”. A similar query was used to identify records with “I” or “P” classifications in 

three, two and one field(s). The SMEs then collectively collated, analyzed, compared, and 

documented the results of these queries. The intent of this effort was to enable the ; 

identification, validation, and characterization of cross-relationship, pattern, association, 1 

and impact dependencies. ! 

1 

The results of this analysis are presented in Section 5 of this report. ! 


4.3 CASE STUDY: POSTULATED HEALTH MONITORING SYSTEM 

The purpose of this section is to validate the analysis approach described in the previous 
sections by identifying a postulated health monitoring capability for a selected component. 
For this analysis, it was not necessary to develop a complete HM system design. It was 
only necessary to identify the sensing and monitoring approach and the primary features of 
the postulated capability. 

The case study that was chosen for this analysis is the realization of structural HM 
capability on the 757 horizontal stabilizer and elevators. The 757 was selected because: 

• The 757 is a current-generation jet transport, which has sensing, electronic, 
and data handling capabilities (e.g., ARINC 717 characteristic) that are more 
advanced than earlier aircraft. 

• The service times for high-time 757 aircraft (in terms of calendar time as well 
as flight hours and cycles) are reaching levels where the structures will need to 
be considered in structural aging assessments. 
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• Technical data related to the 757 were available from NASA, which operates a 
757-200 as a test aircraft. 

The horizontal stabilizer and elevators were chosen because they have a variety of 
structures (aluminum skin-stringer and composite honeycomb panels); a mix of 
mechanical, hydraulic, and electronic components; and interfaces to critical aircraft control 
systems. 

The analysis assumes that the structural HM capability is part of an integrated HM system, 
which would have access to FOQA-type flight-recorder data to provide information to the 
HM modules. Considerations for the implementation and certification of integrated HM 
systems were discussed in previous sections of this report, but are beyond the scope of this 
case study assessment. 

The assumed structural HM capability was developed based on sensor and system 
capabilities that will available in the near- to mid-term. The overall certification process 
identified in Chapter 3 was used to identify applicable regulation and guidance documents 
for search. Database queries were developed based on the functional and operational 
requirements of the individual components. The results of this case study are presented in 
this section. 


4.3.1 757 Horizontal Stabilizer and Elevator Descriptions 

The 757 horizontal stabilizer and elevators provide pitch control for the aircraft. Pitch 
control components can be found in the flight deck (e.g., control columns), below the 
flight deck floor (e.g., torque tubes, column and “feel” controls), and in the tail (e.g., 
elevators, power control units [PCUs], horizontal stabilizer, stabilizer jackscrew, stabilizer 
position modules, and trim control modules). 

The stabilizer structural arrangement is shown in Figure 4-1. The horizontal stabilizer 
includes (from forward to aft) the leading edges, stabilizer tips, a forward torque box, the 
aft (main) torque box, trailing edge panels, and elevators. Structural descriptions of the 
horizontal stabilizer components follow. 

• (Removable) leading edge - aluminum alloy sheet mounted to the auxiliary 
spar of the forward torque box 

• Stabilizer tip - composite honeycomb (aramid/epoxy f with glass/epoxy outer 
ply) mounted to the stabilizer torque box tip rib 

• Forward torque box - built up from aluminum alloy components, including 
upper and lower skin sheets, an auxiliary spar, and ribs mounted to the front 
spar of the main torque box 


r Later aircraft (and spares) have glass/epoxy tip construction 
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• Main torque box - built up from aluminum alloy components and includes 
forward and rear spars, stiffened skins (sheet-stringer construction), and ribs. 
The left and right torque boxes are connected at an aluminum root fitting. 

• Fixed trailing edge - stiffened aluminum alloy ribs with composite honeycomb 
skins (hybrid constructions 5 of carbon/epoxy and aramid/epoxy) mounted to 
the rear spar of the main torque box 

• Elevators - composite honeycomb construction (carbon/epoxy) upper and 
lower panels, front spar and ribs mounted to the rear spar of the main torque 
through eight hinges 

The focus of this analysis will be on the most significant structures — the main torque box 
(with ballscrew and actuators) and elevators (with hinges and actuators). 



FIGURE 4-1. Structural arrangement of the B757 horizontal stabilizer. Source: 
Boeing 757 Maintenance Training Manual. ©1992 The Boeing Company. All 
Rights reserved. Reprinted with permission of FlightSafety Boeing Training 
International L.L.C., under license from the Boeing Company. 


4.3.1. 1 Main Torque Box 

The horizontal stabilizer provides long-term control of aircraft pitch. A ballscrew actuator 
assembly (Figure 4-2), driven by two hydraulic motors, attaches at the center of the front 
spar and mounts through a gimbal to the structure at the bottom of the stabilizer 

8 Later aircraft (and spares) have glass/epoxy trailing edge panel construction 
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compartment of the aft fuselage. Two stabilizer trim control modules (SCTMs) control the 
hydraulic power to the ballscrew actuator. Two pivot fittings attached near the center of 
the rear spar of the main torque box establish the stabilizer pivot point. 

The main torque box is the primary structural element of the horizontal stabilizer. It 
carries moderate structural loads including the aerodynamic loads experienced during 
flight and supports the weight of, and induced torsion from, the elevators. The torque box 
is a conventional aluminum skin-stringer construction. The outer skin sheets are stiffened 
with stringers riveted to the skins in a spanwise orientation (i.e., from inboard to 
outboard). The stiffened skins are fastened to the front and rear spars. Rib structures 
provide torsional stability. 


STABILIZER 



FIGURE 4-2. Horizontal stabilizer ballscrew actuator 
assembly. Source: Boeing 757 Maintenance Training 
Manual. ©1987 The Boeing Company. All Rights reserved. 
Reprinted with permission of FlightSafety Boeing Training 
International L.L.C., under license from the Boeing 
Company. 


4.3. 1.2 Elevators 

The elevators provide short-term corrections of aircraft pitch (long-term pitch control is 
transferred from the elevators to the stabilizer). The elevators are attached to the rear spar 
of the main torque box of the horizontal stabilizer at 8 hinge fittings. Elevator actuation is 
accomplished by 6 (3 on each side) parallel power control units (PCUs; see Figure 4-3). 
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The PCUs are powered by three separate hydraulic systems (left, right, and center), which 
each drive two PCUs ( 1 on each side). The PCUs are attached to the rear spar of the 
stabilizer rear spar by a block and an idler link. Reaction links transmit the hinge loads 
from the elevator to the rear spar of the stabilizer. Control rods connect the PCUs to the 
aft mechanism components — left and right aft quadrants, autopilot servos, a feel and 
centering unit, and a neutral shift and override component. The aft mechanism 
components transmit flight deck inputs to the elevator actuation systems, control elevator 
feel and centering, and limit relative motion of the two elevators for structural protection. 


The principal structural element of the elevators consists of skin panels, ribs, and front 
spar honeycomb sandwich constructions fabricated from carbon/epoxy composite pre- 
impregnated fabric facesheets cocured with aramid honeycomb core. The skin panels are 
mechanically fastened to the front spar and a bonded trailing edge. Mechanically fastened 
ribs provide torsional stability. Elevator hinge and actuator fittings are constructed from 
aluminum and mechanically fastened to the front spar, with glass/epoxy isolation plies and 
surface sealant to prevent galvanic corrosion. 




CONTROL VALVE 
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FIGURE 4-3. Elevator actuation systems. Source: Boeing 757 
Maintenance Training Manual. ©1992 The Boeing Company. All Rights 
reserved. Reprinted with permission of FlightSafety Boeing Training 
International L.L.C., under license from the Boeing Company. 


4.3.2 Structural Considerations 


Large commercial transport aircraft (FAR Part 25) and most large military aircraft are 
designed to be fail-safe, relying on multiple, redundant load paths or crack arrest features 
to preclude catastrophic failures in the event of fatigue, corrosion, manufacturing defects. 
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or accidental damage. h In some cases, fail-safe requirements are impractical for specific 
components. In these cases FAR 25 requires that safe-life analyses be performed. Safe-life 
structure must be shown by analysis, supported by test evidence, to be able to withstand 
the operational cycles without detectable cracks. 

Only three principal degradation modes — accidental damage, environmental deterioration, 
and fatigue damage — are considered in developing structural inspection and maintenance 
tasks. However, these three modes (and combinations thereof) are inclusive of virtually all 
of the mechanisms observed for aircraft structure. This section applies these modes to the 
stabilizer and elevator structures so that strategies for structural HM can be formulated. 


4.3.2. 1 Main Torque Box 

Accidental damage to the stabilizer could arise from a number of rare events. These events 
could include: 

• Unexpected flight or maneuver loads 

• Failure of stabilizer or elevator control components 

• Bird strikes 

• Damage from in-flight failure of other components 

• Ramp and maintenance damage [ 1 5] 

Environmental damage to the stabilizer main box would be in the form of corrosion. 
Susceptible areas include lower skin panel areas where corrosion protection or drainage 
provisions fail or exposed areas with mechanically fastened joints (e.g., attachment points 
for elevator actuation or hinge fittings) or components susceptible to fretting or wear 
(e.g., ballscrew assembly and attachments). The maintenance program includes a 
mandatory corrosion protection and control program, which includes inspection and 
preventive maintenance tasks. 

Fatigue damage of the horizontal stabilizer would most likely be limited to low-cycle 
fatigue, unless elevator damage or repair introduced unexpected flutter modes. The 
stabilizer structure could develop low cycle fatigue, either from the growth of a single 
crack from discrete source damage or from the development of widespread fatigue 
damage (WFD). Empennage structure that is susceptible to WFD includes chordwise 
splices, rib-to-stiffener attachments, skin runouts of large doublers, and stringer runouts at 
end ribs [16]. 


4.3.2.2 Elevators 


h 


Durability and damage tolerance requirements are specified in §25.571. 
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Accidental damage to the composite structure of the elevators would arise from similar 

scenarios as described above for the stabilizers. In addition, one of the primary concerns 

with damage tolerance in composites, especially thin-skinned structures, is the detection of 

damage from low-velocity, discrete source impacts, either during flight or due to ramp or 

maintenance damage. Composite structures are designed to be damage tolerant in the case 

of barely visible impact damage (BVID), that is, damage at the threshold of detectability 

[17]. These criteria require that components maintain their structural integrity following j 

any impact event that does not cause damage that is detectable using visual methods and ; 

that the damage not grow under service environmental conditions. For compliance with 

§25.57 1(b), it must be considered that BVID could occur early in the life of the aircraft 

and would go undetected for the life of the structure. 

Environmental damage to the elevators could include moisture incursion into honeycomb 
core, galvanic corrosion of adjacent metallic structure, or lightning strike damage. 

i 

To date, fatigue damage of composite structures is rare in commercial aircraft. This is 
largely because damage tolerant criteria and environmental knock-down factors for 

composites keep allowable operating strains for composites well below threshold levels j 

required for the growth of damage. The exception is the growth of interply delaminations j 

resulting from over-tightened fasteners. Also, metal hinge and actuator fitting structures ! 

could be susceptible to low-cycle fatigue. Finally, elevator damage or poorly-devised ; 

structural repairs could cause the development of flutter modes that lead to the I 

development of high-cycle fatigue. If undetected, high-cycle fatigue could lead to rapid : 

growth of existing manufacturing or service damage. 


4.3.3 Postulated HM System Capability (757 Horizontal Stabilizer) 

This section develops a postulated structural HM capability for the 757 horizontal 
stabilizer based on the structural degradation considerations discussed in the previous 
section, the system capabilities that were described in Section 2, and the assumed 
availability of state-of-the-art sensors. 

The postulated health monitoring system assumes the availability of system elements, 
including sensor systems; sensor data conditioning units; on-board diagnostic systems and 
algorithms; interfaces with on-board power, data, and communications systems, and a 
ground-based diagnostic system. 

Multiple types of structural sensors will be needed to detect the indications of degradation 
described in the previous section. For the most part, the postulated structural HM system 
focuses on fiber optic and fiber ultrasonic sensors. These sensors are attractive because of 
their small size, the ability to multiplex sensor elements, and because they are not likely to 
interfere with adjacent flight systems and are not susceptible to electromagnetic 
interference effects. 
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The strategy for corrosion monitoring is to focus on early detection of incipient corrosion 
or, preferably, detection of when the corrosion prevention scheme has failed. Candidate 
sensors have been identified to (1) identify when corrosion protection has broken down to 
a point where moisture can intrude, (2) identify the presence of corrosion by detecting 
corrosion products, and (3) identifying the conditions for corrosion by monitoring pH. For 
example, preliminary assessments by Luna Innovations have shown that long-period- 
grating (LPG) optical fiber chemical sensors, with tailored coatings, could effectively 
discern the presence of significant moisture, the metal ions indicative of corrosion 
products, or the pH of a potential electrolyte solution [18, 19]. LPG sensors can be 
multiplexed, that is multiple sensing elements can be deposited on a single optical fiber. 
Multiplexing sensor elements could be an effective way to provide dense sensor placement 
with minimum intrusiveness. 

To effectively monitor materials degradation from fatigue, the sensor system must be 
capable of detecting crack initiation or the propagation of very small cracks. Candidate 
sensors have been identified to (1) identify when a fatigue crack has initiated or when an 
existing crack grows, and (2) monitor crack growth. The sensing strategy is to detect 
initiation and crack-growth events using acoustic emission sensors and to monitor 
subsequent crack growth by measuring near-field strains and comparing them to far-field 
strains to infer, with the aid of structural analysis models, crack growth characteristics. 
Fiber-optic strain and acoustic emission sensors (AE) based on extrinsic Fabry-Perot 
interferometry (EFPI) are being evaluated for these applications [22]. 

Sensors to detect discrete-source events include the EFPI strain and AE sensors described 
above. In addition, out-of-plane AE sensors, also based on EFPI technology, but with a 
cantilever sensing element, would be needed to detect out-of-plane acoustic waves 
resulting from impact events. Finally, grids of embedded fiber ultrasonic sensors have been 
shown to be sensitive to impact damage in composites. These types of sensors, in 
combination with acoustic emission sensors, would be required to detect and characterize 
low-velocity impact damage in thin sheet composites. 

To effectively monitor damage events, corrosion and environmental deterioration, and 
fatigue, an array of multiple sensor types will be required. For example: 

• A chordwise splice in the lower stabilizer skin could have moisture, corrosion 
product, and pH sensor elements distributed adjacent to the splice joint to monitor 
corrosion protection; strain sensors along rows of fasteners and in-plane AE 
sensors to detect fatigue cracking events and monitoring crack growth; and strain 
and out-of-plane AE sensors to detect discrete damage events. 

• An upper elevator skin could have out-of-plane AE sensors to detect discrete 
damage events or lightning strikes; embedded fiber ultrasonic sensors to locate and 
characterize impact damage; and moisture sensors to detect moisture intrusion into 
honeycomb core. 
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Signals from these multiple sensor inputs would pass through multiplexing and signal 
conditioning systems and sent through existing data buses to the diagnostic processor. 

Strategies for sensor interrogation, data management, and diagnostics/prognostics will 
depend on the attribute being sensed, the kinetics of the degradation processes, and the 
phase of flight that is under consideration. For example, measurements for corrosion 
monitoring would be most meaningful between flights (under ambient conditions) and 
would only have to be taken on the order of once per day. For the purpose of this case 
study, we have assumed that measurements would be analyzed with off-board diagnostics 
and prognostics at approximately the same intervals as A-checks (approximately monthly) 
to flag areas for inspection and maintenance actions. Fatigue and discrete damage 
monitoring for the stabilizer and elevator would require a focus on flight load conditions, 
requiring frequent interrogation during transitional phases of flight, limited on-board 
diagnostics for preliminary evaluation of measured conditions, and off-board diagnostics 
and prognostics to characterize structural condition. 


4.3.4 Assessment of Regulatory Guidance: Case Study 


The applicability of airworthiness and operating regulations are described in Section 2 of 
this report. The following FARs apply to the certification and operations of the 757. For 
the purpose of this case study, it was assumed that the airworthiness requirements of Part 
25 would apply. The 757 is also available in freighter variations (i.e., 757-200F), which 
would be subject to the (similar) airworthiness requirements of Part 23. 


Part 21 
Part 25 
Part 39 
Part 43 
Part 1 19 
Part 121 

Part 145 
Part 183 


Certification Procedures for Products and Parts 
Airworthiness Standards: Transport Category Airplanes 
Airworthiness Directives 

Maintenance, Preventive Maintenance, Rebuilding, and Alteration 
Certification: Air Carriers and Commercial Operators 
Certification and Operations: Domestic, Flag, and Supplemental 
Operations 
Repair Stations 

Representatives of the Administrator 


In similar fashion to that employed for the assessment of general regulatory guidance, 
tailored queries were developed to interrogate the regulatory archive. A number of related 
terms (shown in bold) were searched, including actuator, controls, corrosion, elevator, 
fatigue, structur*, and stabilizer. The queries resulted in a number of “hits,” which were 
assessed by a SME in materials and structures. The results are described in Section 5. 
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SECTION 5 

ASSESSMENT RESULTS 


5.0 INTRODUCTION 

This section includes the results of the assessment of regulatory impacts on the 
implementation of HM systems for commercial transport aircraft. First, the results of the 
regulatory assessment are discussed for general HM systems applications and for the 
specific case study example. Second, the factors to be considered in the certification and 
approval of HM systems are identified. 

5.1 REGULATORY ASSESSMENT RESULTS 

This section summarizes the results of the systematic assessment of regulations to identify 
barriers to the implementation of HM systems. The regulatory data archive contained 
almost 2600 records. The search of general terms resulted in approximately 800 “hits” of 
records that were subsequently assessed for their impact on the implementation of HM 
systems. Of the records reviewed, 131 were identified as barriers to the implementation of 
HM systems. Of the 131 records, 44 were FAR paragraphs, 32 were AC sections, and 55 
were 737 or 757 ADs. The archive data results are tabulated in Appendix B. 

FARS 


Table B-l of Appendix B summarizes the impacted records for FAR sections. No 
regulations were identified that explicitly prohibited the general utilization of HM systems 
or the implementation of the postulated HM system for the 757 stabilizer and elevators. 
For the most part, regulatory guidance is general in nature and does not restrict the 
application of advanced technology for compliance. In general, the impacted records were 
one of three types. 

The first type calls for the use of nondestructive inspection methods or tools where a 
proven HM system could take the place of the inspection as well as the assessment tasks. 

For example, §25.61 1 (Accessibility Provisions), requires that: 

“Means must be provided to allow inspection (including inspection of principal structural 
elements and control systems), replacement of parts normally requiring replacement, adjustment, 
and lubrication as necessary for continued airworthiness.” 

And allows that: 


“Nondestructive inspection aids may be used to inspect structural elements where it is 
impracticable to provide means for direct visual inspection if it is shown that the inspection is 
effective and the inspection procedures are specified in the maintenance manual required by Sec. 


25 . 1529 ” 
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Expanding the section to recognize HM capabilities would allow “certificated health- 
monitoring systems” to be used “to assess the condition of the structural elements.” In 
some cases (e.g., §H25.3, [Maintenance Manual] Contents), specific inspection methods 
such as radiographic or ultrasonic methods are called out as examples of “special 
inspection techniques. In these cases reference to HM system instruction should be made. 

The second type of impacted record is when instructions are given to establish inspection 
intervals based on an assessment of detectability and consequence of failure. 


For example, FAR 23, §G23.4 (Airworthiness Limitations Section) requires that the 
airworthiness limitations section: 

“...must set forth each mandatory replacement lime, structural inspection interval, and related 
structural inspection procedure required for type certification.” 

An attractive target for structural HM systems will be to replace mandatory structural 
inspections that are based primarily on service intervals, irrespective of actual structural 
condition. HM systems will allow continuous monitoring and assessment of structural 
condition, making invasive periodic inspection unnecessary. The regulations should be 
updated to allow HM systems as a means for complying with mandatory structural 
inspections. 

FAR Part 25, §25.603 requires that: 

“The suitability and durability of materials used for parts, the failure of which could adversely 
affect safety, must-- ' . ' 

(a) Be established on the basis of experience or tests; ; 

(b) Conform to approved specifications (such as industry or military specifications, or 
Technical Standard Orders) that ensure their having the strength and other properties 
assumed in the design data; and 

(c) Take into account the effects of environmental conditions, such as temperature and 
humidity, expected in service.” 

Hence, the effects of placing sensors on, or embedding sensors in, structural materials 
must be accounted for. For example, the surface preparation and bonding processes used 
to attach sensors need to be evaluated to show that materials performance is not affected. 
Of particular concern would be the restoration of corrosion protective finishes once 
sensors are applied. Another example is embedding a grid of sensor fibers (as described 
above for detection of BVID using fiber ultrasonic techniques) within composite 
structures. This could require the applicant to show that the material properties and the 
long-term durability of the finished components are equivalent to the original certificated 
configuration. 1 Depending on the coverage of the sensor grid and the process used to 


' Recognizing the potential barrier to implementation of embedded sensors that could change the qualified 
materials, work is underway to use the existing reinforcement fibers as the ultrasonic waveguide in the 
fiber ultrasonic technique. 
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embed the sensor fibers, the composite material could be required to go through an 
extensive qualification program. 

The airworthiness requirements of §25.571 require that structural inspections and CMRs 
be developed to monitor structural durability based on the ability to detect the 
development of structural damage that could progress to primary component failure or 
degrade residual strength to a point where fail-safety is compromised. Sensor-based HM 
systems would be likely to improve the ability to detect the precursors to structural failure. 
Therefore, once the accuracy, effectiveness, and reliability of HM approaches have been 
shown to improve the ability to detect structural degradation, provisions will need to be 
made in FAR 25 allowing HM systems to be used to fulfill mandatory inspection and 
maintenance requirement (i.e., obtain maintenance credits) so that structural inspection 
programs, corrosion prevention and control programs, and CMRs can be modified to 
eliminate unnecessary inspections or increase inspection intervals. 

The third type of impacted record included operational considerations such as personnel 
training, authority for approving the analysis results and releasing the aircraft for 
passenger service, and inspection and maintenance process recording and approvals. As 
described earlier in this report, HM systems could facilitate the implementation of FOQA 
or FOQA-like programs by automating the analysis and record-keeping functions. 
However, current regulations could require revision to ensure that HM system recording 
procedures are compatible with required documentation practices. Also, operational 
protocols must be developed to respond to indications of component degradation, reset 
the HM system after maintenance or modification, and authorize return to service. 
Although it is not clear that changes to regulations will be needed, these sections should 
be considered in design processes as the operational issues for HM systems are resolved. 


Advisory Circulars 

Table B-2 of Appendix B summarizes the impacted records for AC sections. In general, 
these ACs provide guidance and regulatory interpretations for compliance with FAR 
requirements. The indicated sections should be examined and updated to include guidance 
for utilizing the capabilities of HM systems in the development of maintenance and 
inspection tasks and intervals. 

For example, Chapter 4 of AC 120-16C, “Continuous Airworthiness Maintenance 
Program,” provides descriptions of the elements of a continuous airworthiness program. 
The subsections that aircraft inspection and scheduled maintenance refer to “prescribed 
intervals” for inspection and scheduled maintenance. The most-effective procedures for 
application of HM systems would consider “continuous inspection and assessment” and 
“condition-based” maintenance, scheduled based on indications of precursors to failure. 

Another example is Chapter 2 of AC 120-17A, “Maintenance Control by Reliability 
Methods,” which specifies “typical” reliability control systems, which would include a 
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data-collection system, and data-analysis system, corrective-action system, statistical 
performance standards system, and data display and report system. An HM system would 
combine and automate much of the functionality of reliability control systems. 


Airworthiness Directives 

An argument could be made that ADs, especially those pertaining to structural inspections 
and modifications (e.g., the ADs shown in Table 2-3), are barriers to implementation 
because they prescribe specific methods of compliance. Most ADs allow for “alternative 
means of compliance,” as long as they have been approved by the FAA. However, because 
of the conservatism of the airline industry and the potential liability in safety-related 
actions, air carriers would generally be reluctant to seek alternative methods to those 
suggested by the manufacturer. Therefore, once HM technologies have been proven, ADs 
should be revised to explicitly allow “certificated health-monitoring systems” as a means 
for compliance. 

5.2 CERTIFICATION OF HEALTH MONITORING SYSTEMS 

To be certified by the FAA and approved for use on commercial transports, the HM 
systems would be subjected to the general type certification process described in Section 
2. However, there are unique considerations for HM systems that must also be addressed 
during the design and certification processes. This section identifies those unique 
considerations and suggests means for showing compliance with the applicable 
regulations. 

Unless developed by the holders of the initial TC, the design and manufacture of health- 
monitoring systems would be approved with an STC. There are two primary aspects to 
consider in the implementation of HM systems for commercial aviation — (1) airworthiness 
certification of the on-board system and (2) qualification and approval of HM system 
capabilities as part of the airline maintenance program. 


5.2.1 Airworthiness Certification: System Design and Analysis 

The airworthiness certification requirements that apply to on-board HM systems for large 
commercial transports (Part 25) are described in §25.1309 “Equipment, Systems, and 
Installations.” This section requires that: 

‘The airplane systems and associated components, considered separately and in relation to other 
systems, must be designed so that: 

(1) The occurrence of any failure condition which would prevent the continued safe flight and 
landing of the airplane is extremely improbable, and 
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(2) The occurrence of any other failure conditions which would reduce the capability of the 
airplane or the ability of the crew to cope with adverse operating conditions is improbable." 

This section also requires that compliance be shown primarily by analysis that considers: 

(1) Possible modes of failure, including malfunctions and damage from external sources 

(2) The probability of multiple failures and undetected failures 

(3) The resulting effects of failures on the airplane and occupants, considering the stage of flight 
and operating conditions 

(4) The crew warning cues, corrective action required, and the capability to detect faults 


Although the guidelines emphasize that compliance would be shown principally by 
analysis, this analysis must be supported by ground, flight, or simulator tests. Examples of 
special requirements to show compliance with the airworthiness regulations could include 
the following: 

• The installation would have no adverse effect on the function or performance of 
existing aircraft systems 

• Sensors and on-board systems would be reliable, durable, and self-diagnostic 

• Misleading information or false alerts passed to the flight crew would be rare 

• Power requirements are compatible with power management considerations under 
failure conditions (e.g., engine-out requirements) 

• All HM system software would comply with requirements for the software aspects 
of certification set forth in RTCA/DO-178B 

• The application or embedding of sensors would not affect the structural integrity 
or function of existing components 

FAA-suggested guidelines for compliance with §25. 1309 are explained in FAA Advisory 
Circular AC 25. 1309-1 A. Fundamentally, installations must adhere to the fail-safe design 
concept, which identifies the effects of failures (including combined failure events) on the 
safety of the design. The tenets of a fail-safe aircraft design are that: 

• The failure (regardless of probability) of any single element, component, or 
connection in any system or subsystem would not prevent continued safe flight or 
landing or significantly reduce the capability of the aircraft or flight crew to cope 
with the resulting failure conditions 

• Unless the joint probability of occurrence with an initial failure can be shown to be 
extremely improbable, subsequent failures during the same flight (either detected 
or latent) would not prevent continued safe flight or landing or significantly reduce 
the capability of the aircraft or flight crew to cope with the resulting failure 
conditions 

Several qualitative (e.g., design appraisal, installation appraisal, failure modes and effects 
analysis, and fault tree analysis) and quantitative (e.g., probability analysis) techniques to 
assess potential failure conditions are considered to be acceptable for showing compliance 
with airworthiness criteria. As would be expected, the applicable techniques will depend 
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on the nature of the system components, design approach, and similarity with proven 
systems. In general, these techniques consist of a structured and detailed assessment of the 
overall system as well as individual components or subassemblies. 

An important consideration in the analysis of HM systems for certification is the 
assessment of software design. However, the compliance methods described for systems 
hardware are not applicable to software because it is not feasible to identify the numbers 
and kinds of software errors that could remain in a system. In response to this difficulty, 
the aeronautical industry, through a special committee of RTCA (Requirements and 
Technical Concepts for Aviation), developed guidelines for the production of software for 
airborne systems and equipment that assure levels of safety in compliance with 
airworthiness requirements [20]. The guidelines establish industry best practices for safety- 
critical software and impose the technical discipline to ensure that these practices are 
followed and documented. 


5.2.2 Operational Evaluations of HM Systems 

The conformance of the airborne components of HM systems to TC airworthiness 
requirements is only one of the regulatory hurdles that must be cleared. In addition, HM 
systems will require approval of the total system, including the airborne and ground 
system components, as an inspection and diagnostic tool to fulfill the operator’s 
requirements for continued airworthiness, continuous monitoring and surveillance, 
supplemental structural inspections, and CMRs. 

As described in previous sections, the AEG will evaluate operational suitability and 
reliability of the system as part of the type certification process. The HM system 
manufacturer must also demonstrate that the system is suitable to perform automated 
inspections or checks as part of airline maintenance program. In effect, the HM system 
would have to be shown to provide equivalence with existing inspection methods and 
intervals. The introduction of new HM systems could be simplified if the initial 
applications were to fall within the FOQA program guidelines, that is, limited to collection 
and post-flight analysis of flight performance measurements. 

As discussed in Section 3, the manufacturer would work with the operator to develop 
maintenance task revisions based on the expected maintenance credits that would be 
enabled by the automated HM system. These task revisions (described above for the 
postulated capability) would be incorporated into the air carrier’s maintenance manual and 
submitted to the FAA for approval. The operators will rely on the ability to simplify 
inspection and maintenance tasks for cost effective implementation of HM systems. 

5.2.3 Industry Standards Applicable to Health Management 
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Several commercial and military standards have been developed to assist in the test and 
diagnosis of complex systems. Military standards are only weakly supported at this time, 
in that US DoD policy requires a waiver to use these in favor of industry, consensus 
standards or performance specifications. In many instances, commercial standards 
replacements are not available. Most commercial standards related to testing and 
diagnostics are oriented around digital test and are limited to the chip or board levels. 
Frequently, the best use of standards in support of aircraft health monitoring and health 
management lies in providing standard communication protocols and interfaces between 
elements in the system being monitored, ground-based support systems, and the health 
monitoring system itself. 

The following is a brief compilation of available standards that would impact aircraft 
health management. The focus of this compilation is on the integration of ARINC and 
IEEE standards within the framework outlined by RTCA/DO-178B. 


5.2. 3.1 RTCA Standard 

RTCA/DO- 178B Software Considerations in Airborne Systems Qnd. Equipment 
Certification — This document provides the aviation community with guidance for 
determining, in a consistent manner and with an acceptable level of confidence, that the 
software aspects of airborne systems and equipment comply with airworthiness 
requirements. The very fact that an on-board health management system resides on the 
aircraft brings its development under DO-178B. Further, since the health management 
system will impact maintenance processes, thereby likely having a direct impact on the 
airworthiness of the aircraft, it would most likely be classified as important to safety 
(Level C or above, probably Level By [4]. 


5.2.3.2 ARINC Standards 

ARINC 429 Mark 33 Digital Information Transfer, System — Defines the air transport 
industry's standards for digital data transfer between avionics equipment elements. These 
standards apply to intra-system communications where system elements or equipment are 
defined in the various ARINC 700-series Characteristics. It is expected that, on older 
aircraft, the 429 bus will be the primary communications path for capturing and 
transferring health management data. 

ARINC £20 Data Link GwuruL System Standard^ and Interface, Specification — Sets forth 
the desired interface characteristics of the data link service provider to the data link user. 


j Software level classifications are assigned based on assessments of the contribution of software to 
potential failures and the consequences of failure. D0-178B [20] defines Level C as software whose failure 
“would cause or contribute to a failure of system function resulting in a major failure condition for the 
aircraft” and Level B as software whose failure “would cause or contribute to a failure of system function 
resulting in a hazardous/severe major failure condition for the aircraft.” 
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Provides data link users the information needed to develop applications and to encourage 
uniformity and standardization (to the extent possible) among various data link service 
providers. Contains general and specific guidance concerning the interfaces between the 
data link service providers and both the airborne and ground user. This is the specification 
that defines the message formats for the Aircraft Communications Addressing and 
Reporting System (ACARS). Health management messages can be formatted according to 
ARINC 620 for communications with ground-based maintenance personnel. 

ARINC 624 Design Guidance for Onboard Maintenance System — Avionics maintenance 
practices continue to improve through On-Board Maintenance System (OMS) recording. 
The OMS incorporates fault monitoring fault detection, BITE, and aircraft condition 
monitoring system. On-board health monitoring and health management systems are likely 
to interact with the existing OMS and, perhaps, be integrated directly with the OMS. 

ARINC 629 Multi-Transmitter Data Bus — Defines the aviation industry standards for 
transfer of digital data between avionics system elements using a multiple access, bi- 
directional protocol. Developed to provide an efficient data distribution system resulting in 
a reduction in the amount of aircraft wiring and equipment interfaces. It is expected that, 
on new aircraft, the 629 bus will be used (probably in conjunction with 429 buses) as the 
primary communications path for capturing and transferring health management data. 

ARINC 763 Network Sen'er System — The network server system specification defines a 
common file server, data processing, mass storage and interface capabilities to a number 
of terminals connected via an onboard aircraft Local Area Network (LAN). The Network 
Server System (NSS) is a central node through which terminals are able to communicate 
with avionics systems, access data and applications stored in the NSS mass memory 
storage. Given the data-intensive nature of on-board health management, the NSS will 
most likely serve as the central repository for storage of health monitoring and 
management data. 

5.2.3. 3 IEEE Standards 


IEEE Std 1232 Artificial Intelligence Exchange and. Service Tie to AU_ Test 
Environments — The AI-ESTATE standard is an information exchange standard for test 
and diagnosis. The original standards, the 1232 series, developed a means of exchange of 
information between diagnostic reasoners. By defining standard diagnostic model formats 
and standard interfaces to diagnostic systems, AI-ESTATE provides a means to 
incorporate diagnostic components to on-board and off-board health management 
systems. These reasoners would form the core analysis capability within the health 
management system. 

IEEE Std 1545 Parametric Data Logging, — The Parametric Test Data Format is defined 
as a log file and transport format for captured, parametric test information. The 
parameters recorded and reported covered a wide frequency range, and the PTDF files are 
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intended to be transferred to a common data repository for analysis and tracking. Much of 
the data captured during health monitoring will be parametric data. By providing a 
standard format for this data, speed and accuracy of data transfer and analysis can be 
improved. 

IEEE Std U49J_ The Test Access Pori and. Boundary Scan Architecture — Defines a 
specific form of scan architecture for integrated circuits and Application Specific ICs 
(ASICs). The standard is typified by scan cells on inputs and outputs of ICs or multi-chip 
models (MCM) to provide observability and controllability without direct probing of the 
circuit. Many avionic systems incorporate ASICs and other complex digital system that 
make use of boundary scan. Access to the boundary scan information could provide 
tremendous benefit in health monitoring. 

IEEE Std 1 149.4 System Level Mixed Signed Scan A rchitecture Protocol — Defines a 
standard for extending digital test and the boundary scan architecture to include mixed 
signal test. Health monitoring will not be limited to digital or discrete information, thus 
raising the specter of having to process both digital and analog information. 

IEEE Std PI 149.5 Standard. Module Test and. Maintenance, (MTM} Protocol — Defines a 
standard for extending the boundary scan architecture to the system level with a test 
maintenance bus and protocols for triggering and reporting tests. This is done by 
providing a dedicated, backplane test bus operating at a system or subsystem level. It is 
possible the MTM could be overlayed on a 429 or 629 bus as a logical layer integrating 
the test information across scan-enabled subsystems. 
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SECTION 6 

CONCLUSIONS AND RECOMMENDATIONS 

Modern commercial transports are configured with sophisticated electronic, propulsion, 
flight control, and structural data systems. In recent years, an increased emphasis has been 
placed on using these data capabilities, in conjunction with emerging sensor, data 
processing, and health monitoring and assessment technologies to characterize the 
condition of aircraft components. The goal is to use real-time flight data to detect system 
flaws or defects or abnormal operating conditions early enough to allow timely 
intervention. 

The implementation of advanced health monitoring technologies will depend on (1) 
acceptance by operators, (2) the ability to gain approval in the FAA certification process, 
and (3) compatibility with continued airworthiness requirements. Once the feasibility and 
cost-effectiveness of health-monitoring systems has been demonstrated to air carriers, the 
ability to navigate the FAA's certification process will be a critical factor in their eventual 
implementation. Fundamentally, it must be shown that the system is passive with respect 
to existing flight systems, that is, the health monitoring system must not interfere with safe 
operation. Second, it must be shown that health-monitoring systems can improve 
continuous airworthiness maintenance programs. The primary consideration for assessing 
the effect of health-monitoring systems on continued airworthiness programs is to 
determine their potential influence on scheduled maintenance programs. 

The purpose of this study was to assess the connection between current FAA regulations 
and the incorporation of health-monitoring systems into commercial aircraft and to 
validate the assessment method on an assumed health monitoring capability. To address 
the overall objectives ARINC (1) investigated FAA regulatory guidance, (2) investigated 
airline maintenance practices, (3) systematically identified regulations and practices that 
would be affected or could act as barriers to the introduction of HM technology, and (4) 
assessed regulatory and operational tradeoffs that should be considered for 
implementation. 


6.1 ACCEPTANCE BY OPERATORS 

Air carriers are required to balance the increasing need for scheduled and unscheduled 
maintenance with requirements to move aircraft through maintenance and keep them as 
productive as they need to be for the airline to remain profitable. Current schedules and 
route structures are such that aircraft could be expected to see as much as 16 hours per 
day of service. High aircraft utilization results in fewer opportunities to bring an aircraft in 
for maintenance. Because of the high hours, “maintenance must be very specific and very 
effective."! 10] HM systems could be an important factor in improving the effectiveness of 
inspection and maintenance programs and enabling focused, condition-based maintenance. 
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Based on the air carrier’s operating requirements and the business climate under which 
they work, there are several requirements or expectations that must be met before HM 
systems can be accepted: 

• documented and convincing cost/benefit relationships 

• potential to improve overall component reliability 

• potential to replace difficult or tedious inspections 

• ability to collect and analyze recurring problems 

• potential to move tasks from line maintenance checks and put them into base 
maintenance visits 

The FAA prefers the methods set forth in the manufacturer's maintenance manual and the 
instructions for continued airworthiness. Alternatively, air carriers can use different 
methods as long as they have been approved as part of their required maintenance manual. 
Therefore, air carriers have the authority to introduce new maintenance and inspection 
techniques and to implement those changes through their manual. Health monitoring 
systems could be an integral part of an airline’s monitoring and surveillance and reliability 
tracking programs. HM systems promise to automate the data collection and analysis 
functions associated with maintenance program review. These capabilities are consistent 
with the goals for FOQA programs. 


6.2 CERTIFICATION 

The objective for implementing HM technology on commercial aircraft is to improve flight 
safety and aircraft availability, and reduce operating costs by augmenting, reducing, or 
replacing difficult or invasive inspections. A key concern that has been voiced by 
commercial transport operators is whether the current regulations would allow the 
approval and introduction of automated HM systems. 

Although the volume of regulations and guidance is daunting, the certification process is 
relatively straightforward. Unless the systems are developed by the holders of the initial 
type certificate for the targeted aircraft model, the design and manufacture of health- 
monitoring systems would be approved with a supplemental type certificate. There are 
two primary aspects to consider in the approval of HM systems for commercial aviation — 
(1) airworthiness certification of the on-board system and (2) qualification and approval of 
HM system capabilities as part of the airline maintenance program. 

The airworthiness certification requirements that apply to on-board HM systems for large 
commercial transports (Part 25) are described in §25.1309 “Equipment, Systems, and 
Installations.” The guidelines emphasize that compliance would have to be shown 
primarily by analysis, supported by ground, flight, or simulator tests. In the case of health- 
monitoring systems the analyses and tests would have to show that: 
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• The installation would have no adverse effect on the function or performance 
of existing aircraft systems 

• Sensors and on-board systems would be reliable, durable, and self-diagnostic 

• Misleading information or false alerts passed to the flight crew would be rare 

• Power requirements are compatible with established power management 
considerations under failure conditions (e.g., engine-out requirements) 

• All HM system software would comply with requirements for the software 
aspects of certification 

• The application or embedding of sensors would not affect the structural 
integrity or function of existing components 

In general, current regulations do not prohibit, but certainly do not encourage, the use of 
HM technologies. 

Production approval would need to be provided to ensure that the manufacturers of 
certificated components are capable of repeatably producing components that represent 
the certification basis. Obtaining a production certificate for installation on a particular 
aircraft type would facilitate approval of subsequent installations on the same aircraft type. 
Approval of generally applicable HM system components through Technical Standard 
Orders (TSOs) could facilitate the approval of health-monitoring system components, 
including sensors and signal-conditioning hardware and on-board processors. 


6.3 CONTINUED AIRWORTHINESS 


The conformance of the airborne components of HM systems to airworthiness 
requirements is only one of the regulatory hurdles that must be cleared. In addition, 
approval of the total HM system, including the airborne and ground system components, 
must be sought. The total system must be approved as an inspection and diagnostic tool to 
fulfill the operator’s requirements for continued airworthiness, continuous monitoring and 
surveillance, supplemental structural inspections, and certification maintenance 
requirements. 

The FAA will evaluate The operational suitability and reliability of the system during the 
type certification process. The manufacturer must demonstrate that the system is suitable 
to perform automated inspections or checks as part of an airline maintenance program. In 
effect, the HM system would have to be shown to provide equivalence with existing 
inspection methods and intervals. 

The manufacturer of the HM system will have to work with commercial operators to 
develop maintenance task revisions based on the expected maintenance credits that would 
be enabled by the automated HM system. These task revisions would be incorporated into 
the air carrier’s maintenance manual and submitted to the FAA for approval. The 
operators will rely on the ability to simplify inspection and maintenance tasks for cost 
effective implementation of HM systems. 
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The FAA has the responsibility to oversee these post-certification activities to assure that 
air travel remains the safest form of transportation. The FAA has recently introduced an 
oversight strategy, call the Air Transportation Oversight System (ATOS) that is based on 
a risk management approach to system safety, rather than just audits of regulatory 
compliance. The implementation of ATOS is not expected to represent a barrier to the 
introduction of HM systems. In fact, the focus on risk management and data-driven 
oversight could facilitate the introduction of automated tools like HM. 


6.5 RECOMMENDATIONS 

6.5.1 Implementation of HM Systems 

The goals for implementing HM systems are to reduce operational and maintenance costs 
and to improve aircraft safety. A stepwise approach to certification and introduction of 
HM systems is recommended. This measured approach would allow certification and 
approval processes to be established on simpler systems and expanded to include more 
advanced applications. Specific recommendations include the following. 

Select initial applications carefully. Work with air carriers to identify target parts and 
components for initial applications. Focus on targets that would address certification 
maintenance requirements, unscheduled maintenance problems, difficult or tedious 
inspections, accessibility problems, or component reliability problems. Avoid initial 
applications where HM systems could be viewed as invasive, e.g., where sensors will be 
embedded or integrated into a component (requiring requalification of material or 
recertification of the component). 

Focus initial efforts on the goals of FOQA. ARINC believes that emerging HM 
capabilities will support the data collection and analysis activities required for an effective 
FOQA program. Advanced health monitoring capabilities, which would include prognostic 
capabilities, could identify components with service problems and/or inadequate reliability 
and support improvements in maintenance programs to consider these components. It 
could simplify the introduction of new HM systems if the initial applications were to fall 
within the FOQA program guidelines, that is, limited to collection and post-flight analysis 
of flight performance measurements. The eventual capabilities of HM systems will allow 
real-time diagnostics and aircrew cueing. 

Develop standard system components. Approval of generally applicable HM system 
components through Technical Standard Orders (TSOs) could facilitate the approval of 
health-monitoring system components, including sensors and signal-conditioning hardware 
and on-board processors. 

Focus on proving reliability of systems and approaches. The operators will only seek to 
use HM systems if they can be shown to be reliable substitutes for existing methods. 
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Developers should focus on validating the technical approach to sensor-based HM 
systems. This assessment will also facilitate approval of production certificates. 

Obtain maintenance credit for automated HM systems. Air carriers have the authority to 
introduce new maintenance and inspection techniques and to implement those changes 
through their maintenance manual. The application of HM systems as a method to perform 
a scheduled inspection or check could be implemented in this manner. 

Once the applicability and reliability of HM systems have been proven, the following 
general changes should be sought in the FAA’s regulatory guidance. 

• ADs should be revised to explicitly allow “certificated condition-monitoring 
systems” as a means for compliance. 

• Guidelines and procedures for developing and monitoring maintenance 
programs should include guidance for taking advantage of HM systems in the 
development of maintenance and inspection tasks and intervals. 

• Provisions should be added to the appropriate airworthiness requirements so 
that structural inspection programs, corrosion prevention and control 
programs, and certification maintenance requirements can be modified to 
realize maintenance credits by eliminating unnecessary inspections or 
increasing inspection intervals. 


6.5.2 Further Data Archive Analysis 

The regulatory data archive was a powerful tool to accomplish a systematic assessment of 
applicable regulatory guidance. As the HM system development and design progresses, 
similar analyses of archives containing aircraft safety, maintenance task, and maintenance 
history data, side-by-side with analyses of regulatory considerations, could enable 
systematic analysis of design considerations and trade studies. Examples of the types of 
analyses that could be accomplished include selection of target systems and components 
for HM utilization, cost/benefit trade studies, identification of operational considerations 
for HM systems, analysis of requirements for data collection and recording, and 
requirements for training of maintenance personnel. This section recommends 
enhancements to the data archive system that would facilitate the further utilization of this 
method. 

The regulatory data archive was one of the principal analytical tools used for identifying 
the regulatory areas that could represent barriers to the certification and use of HM 
systems on Transport Category aircraft. The current regulatory data archive was 
structured to use the standard features of Access 97 to enter and extract data, review 
record content, and generate reports. 

This prototype database was sufficient for generally assessing the impact of adding a HM 
capability on current regulatory guidance and for access/use by a small number of co- 
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located users. However, updating current records, adding new information, maintaining 
configuration control, accessing information from remote locations, efficiently generating 
queries and reports required moderately more effort or time than would be required for 
more efficient database structures. 

The current regulatory data archive should be rehosted as a web site to improve 
accessibility and provide proper security provisions. This improvement would eliminate 
the need for individual users to download the entire database into a personal file before 
use, thus improving configuration management and discouraging development of spin-off 
databases. It is also recommended that a more powerful database application be used to 
expand the data archive. These suggested enhancements could: 

• Allow the use of “regular expression” queries to extract information 

• Allow easily tailorable reports on results of queries 

• Allow quick access/linkage with full text documents referred to in a record or as 
desired by the user 

• Allow rapid location of records of interest and visibility on record content 

• Allow controlled entry and update of data in individual records 

• Provide real time visibility on the standards used for categorizing data 

• Provide side by side comparisons of data categorization assignments by multiple 
analysts 

• Allow database size to increase to beyond 20 gigabytes of data 

An expanded database could include such information as aircraft safety data, maintenance 
history data, specific maintenance tasks, supplemental structural inspection requirements, 
and corrosion protection and control tasks. ARINC has developed a database structure 
which provides the above capabilities, that is hosted on an internet web site, and that can 
be used as the basic element of enhancing the current regulatory data archive. 
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APPENDIX A - FEDERAL AVIATION REGULATIONS 


CFR Part No. 


Part 1: 


Part 

11 

Part 

13 

Part 

14 

Part 

15 

Part 

16 

Part 

17 

Part 

21 

Part 

23 

Part 

25 

Part 

27 

Part 

29 

Part 

JLL 

Part 

33 

Part 

34 

Part 

35 

Part 

36 

Part 

39 

Part 

43 

Part 

45 

Part 

47 

Part 

49 


Part 61 
Part 63 
Part 65 
Part 67 


Part 71 : 

Part73: 
Part 77: 


Part 91 : 
Part 93 : 
Part 95 : 
Part 97 : 
Part 99 : 
Part 101 
Part 103 
Part 105 
Part 107 
Part 108 
Part 109 


Part 119: 


CFR Subchapter and Title 

Subchapter A — Definitions and Abbreviations 

Definitions and Abbreviations 

Subchapter B — Procedural Rules 

General Rule-Making Procedures 

Investigative and Enforcement Procedures 

Rules Implementing the Equal Access to Justice Act of 1980 

Administrative Claims under Federal Tort Claims Act 

Rules of Practice for Federally- Assisted Airport Enforcement Proceedings 

Procedures for Protests and Contracts Disputes 

Subchapter C — Aircraft 

Certification Procedures For Products and Parts 

Airworthiness Standards: Normal, Utility, Acrobatic, and Commuter Category Airplanes 

Airworthiness Standards: Transport Category Airplanes 

Airworthiness Standards: Normal Category Rotorcraft 

Airworthiness Standards: Transport Category Rotorcraft 

Airworthiness Standards: Manned Free Balloons 

Airworthiness Standards: Aircraft Engines 

Fuel Venting and Exhaust Emission Requirements for Turbine Engine Powered Airplanes 
Airworthiness Standards: Propellers 

Noise Standards: Aircraft Type and Airworthiness Certification 
Airworthiness Directives 

Maintenance, Preventive Maintenance, Rebuilding, and Alteration 
Identification and Registration Marking 
Aircraft Registration 

Recording of Aircraft Titles and Security Documents 

Subchapter D — Airmen 
Certification: Pilots and Flight Instructors 
Certification: Flight Crewmembers other than Pilots 
Certification: Airmen other than Flight Crewmembers 

Medical Standards and Certification 

Subchapter E — Airspace 

Designation Of Class A, Class B, Class C, Class D, and Class E Airspace Areas; Airways; 
Routes; and Reporting Points 
Special use Airspace 

Objects Affecting Navigable Airspace 

Subchapter F — Air Traffic and General Operation Rules 

General Operating and Flight Rules 

Special Air Traffic Rules and Airport Traffic Patterns 

IFR: Altitudes 

Standard Instrument Approach Procedures 
Security Control of Air Traffic 

Moored Balloons, Kites, Unmanned Rockets and Unmanned Free Balloons 

Ultralight Vehicles 

Parachute Jumping 

Airport Security 

Airplane Operator Security 

Indirect Air Carrier Security 

Subchapter G — Air Carriers and Operators for Compensation or Hire: Certification and 
Operations 

Certification: Air Carriers and Commercial Operators 
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CFR Part No. 


Part 

121: 

Part 

125: 

Part 

129 

Part 

133 

Part 

135 

Part 

137 

Part 

139 


Part 141 
Part 142 
Part 145 
Part 147 


Part 

150 

Part 

151 

Part 

152 

Part 

155 

Part 

156 

Part 

157 

Part 

158 

Part 

161 

Part 

169 

Part 

170: 

Part 

171: 

Part 

183 

Part 

185 

Part 

187 

Part 

189 

Part 

191 


Part 198: 


CFR Subchapter and Title 

Certification and Operations: Domestic, Flag, and Supplemental Air Carriers and Commercial 
Operators of Large Aircraft 

Certification and Operations: Airplanes Having a Seating Capacity of 20 or More Passengers or 
a Maximum Payload Capacity of 6,000 Pounds or More 

Operations: Foreign Air Carriers and Foreign Operators of U.S.- Registered Aircraft Engaged in 

Common Carriage 

Rotorcraft External-Load Operations 

Air Taxi Operators and Commercial Operators 

Agricultural Aircraft Operations 

Certification and Operations: Land Airports Serving Certain Air Carriers 

Subchapter H — Schools and Other Certificated Agencies 

Pilot Schools 
Training Centers 
Repair Stations 

Aviation Maintenance Technician Schools 

Subchapter I — Airports 
Airport Noise Compatibility Planning 

Federal Aid to Airports . .. . _ ^ 

Airport Aid Program 

Release of Airport Property from Surplus Property Disposal Restrictions 
State Block Grant Pilot Program 

Notice Of Construction, Alteration, Activation, and Deactivation of Airports 
Passenger Facility Charges (PFC’s) 

Notice and Approval Of Airport Noise and Access Restrictions 

Expenditure of Federal Funds for Nonmilitary Airports or Air Navigation Facilities Thereon 

Subchapter J — Navigational Facilities 

Establishment and Discontinuance Criteria for Air Traffic Control Services and Navigational 
Facilities 

Non -Federal Navigation Facilities. . j_. 

Subchapter K — Administrative Regulations 

Representatives of the Administrator 

Testimony by Employees and Production of Records in Legal Proceedings, and Service of Legal 

Process and Pleadings 

Fees 

Use of Federal Aviation Administration Communications System 

Withholding Security Information from Disclosure Under The Air Transportation Security Act 
of 1974 

Subchapter N — War Risk Insurance 

Aviation Insurance 


! 
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APPENDIX B - DATA ARCHIVE ASSESSMENT RESULTS 

TABLE B-l. FAR sections with identified potential impacts on HM system introduction. 


id 

Document 

Number 

Document Subpart 

Subpart Title 

Paragraph 

Number 

Paragraph Title 

E3 

Part 21 


dHA ilj .!i#U 1 1 1 J fJEdHH 

Sec. 21.31 

Type design. 


Part 21 

Subpart C 

Provisional Type Certificates 

Sec. 21.81 

Requirements for issue and amendment 
of Class 1 provisional type certificates. 

75 

Part 21 

Subpart C 

Provisional Type Certificates 

Sec. 21.83 

Requirements for issue and amendment 
of Class II provisional type certificates. 

76 

Part 21 

Subpart C 

Provisional Type Certificates 

Sec. 21.85 

Provisional amendments to type 
certificates. 

m3 

Part 21 


Airworthiness Certificates 

Sec. 21.181 

Duration. 

118 

Part 21 

| Subpart H 

Airworthiness Certificates 

Sec. 21.183 

Issue of standard airworthiness 



certificates for normal, utility, acrobatic, 
commuter, and transport category 
aircraft; manned free balloons; and 

special classes of aircraft. 

Sec. 21 .1 84 Issue of special airworthiness certificates 
for primary category aircraft. 


Sec. 21 .329 Issue of export certificates of 
airworthiness for Class I products. 


Sec. 21 .337 Performance of inspections and 
overhauls. 




SFAR No. 23 


Subpart C-Structure 


Miscellaneous 



Appendix G to Part 23 


Appendix G to Part 23 


Instructions for Continued 
Airworthiness 


Instructions for Continued 
Airworthiness 


35 Maintenance information. 

Sec. 23.573 Damage tolerance and fatigue evaluation 
of structure. 


Accessibility provisions. 


Special factors. 


Content. 


Airworthiness Limitations section. 




Subpart D -Design and 
Construction 


Appendix H 


Instructions for Continued 
Airworthiness 


Instructions for Continued 
Airworthiness 


Sec. 25.611 


H25.3 


Accessibility provisions. 


Content. 
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